Technology · Synacor

Synacor Zimbra Collaboration Suite (ZCS) vulnerabilities

Updated 9 November 2026, 03:07 UTC. Rebuilt every hour.

Junglewise Threat Intelligence has tracked 19 vulnerabilities in Synacor Zimbra Collaboration Suite (ZCS): 0 in the last 7 days and 1 in the last 90 days, 19 of them critical and 19 exploited in the wild. The most recent, CVE-2026-73570, was published on 21 August 2026. Nothing was published in the last eight weeks.

Last 7 days: 0
Last 90 days: 1
Critical, all time: 19
Exploited in the wild: 19

About Synacor Zimbra Collaboration Suite (ZCS)

Zimbra Collaboration Suite is an enterprise-grade email and collaboration platform that includes contacts, calendar, tasks, and file sharing.

Homepage

Latest Synacor Zimbra Collaboration Suite (ZCS) vulnerabilities

CVE-2026-73570: Zimbra Collaboration Suite OS command injection in SMTPcriticalexploited in the wildCVSS 9.8EPSS 11.7%21 Aug 2026
CVE-2025-48700: Synacor Zimbra Collaboration Suite XSS in Classic UIcriticalexploited in the wildCVSS 6.1EPSS 18.8%20 Apr 2026
CVE-2020-7796: Synacor Zimbra Collaboration Suite SSRF in WebEx zimletcriticalexploited in the wildCVSS 9.8EPSS 92.7%17 Feb 2026
CVE-2025-66376: Synacor Zimbra Collaboration Suite stored XSS in Classic UIcriticalexploited in the wildCVSS 7.2EPSS 19.6%5 Jan 2026
CVE-2025-68645: Synacor Zimbra Collaboration Suite file inclusion in RestFilter servletcriticalexploited in the wildCVSS 8.8EPSS 48.9%22 Dec 2025
CVE-2025-27915: Synacor Zimbra Collaboration Suite XSS in Classic Web Clientcriticalexploited in the wildCVSS 5.4EPSS 26.1%7 Oct 2025
CVE-2019-9621: Synacor Zimbra Collaboration Suite SSRF in ProxyServletcriticalexploited in the wildCVSS 7.5EPSS 94.1%7 Jul 2025
CVE-2024-27443: Synacor Zimbra Collaboration Suite XSS in CalendarInvitecriticalexploited in the wildCVSS 6.1EPSS 32.4%19 May 2025
CVE-2023-34192: Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) Vulnerabilitycriticalexploited in the wildCVSS 925 Feb 2025
CVE-2024-45519: Synacor Zimbra Collaboration Suite (ZCS) Command Execution Vulnerabilitycriticalexploited in the wildCVSS 9.83 Oct 2024
CVE-2023-37580: Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) Vulnerabilitycriticalexploited in the wildCVSS 6.127 Jul 2023
CVE-2022-27926: Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) Vulnerabilitycriticalexploited in the wildCVSS 6.13 Apr 2023
CVE-2022-41352: Synacor Zimbra Collaboration Suite (ZCS) Arbitrary File Upload Vulnerabilitycriticalexploited in the wildCVSS 9.820 Oct 2022
CVE-2022-27925: Synacor Zimbra Collaboration Suite (ZCS) Arbitrary File Upload Vulnerabilitycriticalexploited in the wildCVSS 7.211 Aug 2022
CVE-2022-37042: Synacor Zimbra Collaboration Suite (ZCS) Authentication Bypass Vulnerabilitycriticalexploited in the wildCVSS 9.811 Aug 2022
CVE-2022-27924: Synacor Zimbra Collaboration Suite (ZCS) Command Injection Vulnerabilitycriticalexploited in the wildCVSS 7.54 Aug 2022
CVE-2018-6882: Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) Vulnerabilitycriticalexploited in the wildCVSS 6.119 Apr 2022
CVE-2022-24682: Synacor Zimbra Collaborate Suite (ZCS) Cross-Site Scripting Vulnerabilitycriticalexploited in the wildCVSS 6.125 Feb 2022
CVE-2019-9670: Synacor Zimbra Collaboration Suite (ZCS) Improper Restriction of XML External Entity Referencecriticalexploited in the wildCVSS 9.810 Jan 2022

Most severe Synacor Zimbra Collaboration Suite (ZCS) vulnerabilities

Exploited in the wild first, then by severity and CVSS score.

CVE-2020-7796: Synacor Zimbra Collaboration Suite SSRF in WebEx zimletcriticalexploited in the wildCVSS 9.8EPSS 92.7%17 Feb 2026
CVE-2026-73570: Zimbra Collaboration Suite OS command injection in SMTPcriticalexploited in the wildCVSS 9.8EPSS 11.7%21 Aug 2026
CVE-2024-45519: Synacor Zimbra Collaboration Suite (ZCS) Command Execution Vulnerabilitycriticalexploited in the wildCVSS 9.83 Oct 2024
CVE-2022-41352: Synacor Zimbra Collaboration Suite (ZCS) Arbitrary File Upload Vulnerabilitycriticalexploited in the wildCVSS 9.820 Oct 2022
CVE-2022-37042: Synacor Zimbra Collaboration Suite (ZCS) Authentication Bypass Vulnerabilitycriticalexploited in the wildCVSS 9.811 Aug 2022
CVE-2019-9670: Synacor Zimbra Collaboration Suite (ZCS) Improper Restriction of XML External Entity Referencecriticalexploited in the wildCVSS 9.810 Jan 2022
CVE-2023-34192: Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) Vulnerabilitycriticalexploited in the wildCVSS 925 Feb 2025
CVE-2025-68645: Synacor Zimbra Collaboration Suite file inclusion in RestFilter servletcriticalexploited in the wildCVSS 8.8EPSS 48.9%22 Dec 2025
CVE-2019-9621: Synacor Zimbra Collaboration Suite SSRF in ProxyServletcriticalexploited in the wildCVSS 7.5EPSS 94.1%7 Jul 2025
CVE-2022-27924: Synacor Zimbra Collaboration Suite (ZCS) Command Injection Vulnerabilitycriticalexploited in the wildCVSS 7.54 Aug 2022

Vulnerabilities per week

Nothing was published in the last eight weeks. The last 13 weeks, by the week each vulnerability was published.

Vulnerabilities published per week, UTC
Week of	Vulns	Critical
17 Aug 2026	1	1
24 Aug 2026	0	0
31 Aug 2026	0	0
7 Sep 2026	0	0
14 Sep 2026	0	0
21 Sep 2026	0	0
28 Sep 2026	0	0
5 Oct 2026	0	0
12 Oct 2026	0	0
19 Oct 2026	0	0
26 Oct 2026	0	0
2 Nov 2026	0	0
9 Nov 2026	0	0

Embed a badge

A live badge for a README, a status page or an internal wiki: how many Synacor Zimbra Collaboration Suite (ZCS) vulnerabilities were published in the last 7 days and how many of them are critical, refreshed hourly.

[![Synacor Zimbra Collaboration Suite (ZCS) vulnerabilities](https://junglewise.ai/threats/technologies/zimbra-collaboration-suite-zcs/badge.svg)](https://junglewise.ai/threats/technologies/zimbra-collaboration-suite-zcs)

<a href="https://junglewise.ai/threats/technologies/zimbra-collaboration-suite-zcs"><img src="https://junglewise.ai/threats/technologies/zimbra-collaboration-suite-zcs/badge.svg" alt="Synacor Zimbra Collaboration Suite (ZCS) vulnerabilities" /></a>

How this is built

Junglewise Threat Intelligence collects vulnerabilities from NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories, and matches each one to the technologies and vendors it affects. Dates are the date a vulnerability was published, in UTC.

The pages are rebuilt from the database every hour. Frozen weekly and monthly reports never change once published, so they can be cited.

Use this data

The same data is at https://junglewise.ai/threats/technologies/zimbra-collaboration-suite-zcs.json, and this page as text at https://junglewise.ai/threats/technologies/zimbra-collaboration-suite-zcs.md, for scripts and language models. It is free to reuse under CC BY 4.0 with a link back to this page.

Cite as: Junglewise Threat Intelligence, "Synacor Zimbra Collaboration Suite (ZCS) vulnerabilities", https://junglewise.ai/threats/technologies/zimbra-collaboration-suite-zcs, 9 November 2026.