Cyberfeed6 › Vendors › Synacor
CISA lists 19 Synacor vulnerabilities as exploited in real attacks, and 6 of them are known to be used in ransomware campaigns. Most entries concern Zimbra Collaboration Suite (ZCS), Zimbra Collaboration Suite, Zimbra Collaborate Suite (ZCS).
Showing the 19 most recently added of 19. Check the vendor notice before you act: it names the fixed versions.
| Vulnerability | Product | Added to list | Severity | Ransomware | Fix |
|---|---|---|---|---|---|
| CVE-2026-73570Zimbra Collaboration Suite (ZCS) OS Command Injection Vulnerability | Zimbra Collaboration Suite (ZCS) | 2026-08-21 | High (8.9) | No | Vendor notice |
| CVE-2025-48700Synacor Zimbra Collaboration Suite (ZCS) Cross-site Scripting Vulnerability | Zimbra Collaboration Suite (ZCS) | 2026-04-20 | Medium (6.1) | No | Vendor notice |
| CVE-2025-66376Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting Vulnerability | Zimbra Collaboration Suite (ZCS) | 2026-03-18 | High (7.2) | No | Vendor notice |
| CVE-2020-7796Synacor Zimbra Collaboration Suite (ZCS) Server-Side Request Forgery Vulnerability | Zimbra Collaboration Suite | 2026-02-17 | Critical (9.8) | No | Vendor notice |
| CVE-2025-68645Synacor Zimbra Collaboration Suite (ZCS) PHP Remote File Inclusion Vulnerability | Zimbra Collaboration Suite (ZCS) | 2026-01-22 | High (8.8) | No | Vendor notice |
| CVE-2025-27915Synacor Zimbra Collaboration Suite (ZCS) Cross-site Scripting Vulnerability | Zimbra Collaboration Suite (ZCS) | 2025-10-07 | Medium (5.4) | No | Vendor notice |
| CVE-2019-9621Synacor Zimbra Collaboration Suite (ZCS) Server-Side Request Forgery (SSRF) Vulnerability | Zimbra Collaboration Suite (ZCS) | 2025-07-07 | High (7.5) | No | Vendor notice |
| CVE-2024-27443Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) Vulnerability | Zimbra Collaboration Suite (ZCS) | 2025-05-19 | Medium (6.1) | No | Vendor notice |
| CVE-2023-34192Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) Vulnerability | Zimbra Collaboration Suite (ZCS) | 2025-02-25 | Critical (9.0) | No | Vendor notice |
| CVE-2024-45519Synacor Zimbra Collaboration Suite (ZCS) Command Execution Vulnerability | Zimbra Collaboration Suite (ZCS) | 2024-10-03 | Critical (10.0) | No | Vendor notice |
| CVE-2023-37580Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) Vulnerability | Zimbra Collaboration Suite (ZCS) | 2023-07-27 | Medium (6.1) | No | Vendor notice |
| CVE-2022-27926Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) Vulnerability | Zimbra Collaboration Suite (ZCS) | 2023-04-03 | Medium (6.1) | No | Vendor notice |
| CVE-2022-41352Synacor Zimbra Collaboration Suite (ZCS) Arbitrary File Upload Vulnerability | Zimbra Collaboration Suite (ZCS) | 2022-10-20 | Critical (9.8) | Yes | Vendor notice |
| CVE-2022-37042Synacor Zimbra Collaboration Suite (ZCS) Authentication Bypass Vulnerability | Zimbra Collaboration Suite (ZCS) | 2022-08-11 | Critical (9.8) | Yes | Vendor notice |
| CVE-2022-27925Synacor Zimbra Collaboration Suite (ZCS) Arbitrary File Upload Vulnerability | Zimbra Collaboration Suite (ZCS) | 2022-08-11 | High (7.2) | Yes | Vendor notice |
| CVE-2022-27924Synacor Zimbra Collaboration Suite (ZCS) Command Injection Vulnerability | Zimbra Collaboration Suite (ZCS) | 2022-08-04 | Critical (9.8) | Yes | Vendor notice |
| CVE-2018-6882Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) Vulnerability | Zimbra Collaboration Suite (ZCS) | 2022-04-19 | Medium (6.1) | Yes | |
| CVE-2022-24682Synacor Zimbra Collaborate Suite (ZCS) Cross-Site Scripting Vulnerability | Zimbra Collaborate Suite (ZCS) | 2022-02-25 | Medium (6.1) | Yes | |
| CVE-2019-9670Synacor Zimbra Collaboration Suite (ZCS) Improper Restriction of XML External Entity Reference | Zimbra Collaboration Suite (ZCS) | 2022-01-10 | Critical (9.8) | No |
Source: CISA Known Exploited Vulnerabilities catalog, released 2026-11-04. Severity scores are CVSS where available. "Ransomware" means CISA has marked the flaw as known to be used in ransomware campaigns.