# Synacor Zimbra Collaboration Suite (ZCS) vulnerabilities Source: https://junglewise.ai/threats/technologies/zimbra-collaboration-suite-zcs Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 9 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/technologies/zimbra-collaboration-suite-zcs.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 19 vulnerabilities in Synacor Zimbra Collaboration Suite (ZCS): 0 in the last 7 days and 1 in the last 90 days, 19 of them critical and 19 exploited in the wild. The most recent, CVE-2026-73570, was published on 21 August 2026. Nothing was published in the last eight weeks. ## Counts - Last 7 days: 0 - Last 30 days: 0 - Last 90 days: 1 - All time: 19 (19 critical, 19 exploited in the wild) ## About Synacor Zimbra Collaboration Suite (ZCS) Zimbra Collaboration Suite is an enterprise-grade email and collaboration platform that includes contacts, calendar, tasks, and file sharing. ## Latest Synacor Zimbra Collaboration Suite (ZCS) vulnerabilities - [CVE-2026-73570: Zimbra Collaboration Suite OS command injection in SMTP](https://junglewise.ai/threats/cve-2026-73570-zimbra-collaboration-suite-os-command-injection-in-smtp) (critical, exploited in the wild, CVSS 9.8, published 21 Aug 2026) - [CVE-2025-48700: Synacor Zimbra Collaboration Suite XSS in Classic UI](https://junglewise.ai/threats/cve-2025-48700-synacor-zimbra-collaboration-suite-xss-in-classic-ui) (critical, exploited in the wild, CVSS 6.1, published 20 Apr 2026) - [CVE-2020-7796: Synacor Zimbra Collaboration Suite SSRF in WebEx zimlet](https://junglewise.ai/threats/cve-2020-7796-synacor-zimbra-collaboration-suite-ssrf-in-webex-zimlet) (critical, exploited in the wild, CVSS 9.8, published 17 Feb 2026) - [CVE-2025-66376: Synacor Zimbra Collaboration Suite stored XSS in Classic UI](https://junglewise.ai/threats/cve-2025-66376-synacor-zimbra-collaboration-suite-stored-xss-in-classic-ui) (critical, exploited in the wild, CVSS 7.2, published 5 Jan 2026) - [CVE-2025-68645: Synacor Zimbra Collaboration Suite file inclusion in RestFilter servlet](https://junglewise.ai/threats/cve-2025-68645-synacor-zimbra-collaboration-suite-file-inclusion-in-restfilter) (critical, exploited in the wild, CVSS 8.8, published 22 Dec 2025) - [CVE-2025-27915: Synacor Zimbra Collaboration Suite XSS in Classic Web Client](https://junglewise.ai/threats/cve-2025-27915-synacor-zimbra-collaboration-suite-xss-in-classic-web-client) (critical, exploited in the wild, CVSS 5.4, published 7 Oct 2025) - [CVE-2019-9621: Synacor Zimbra Collaboration Suite SSRF in ProxyServlet](https://junglewise.ai/threats/cve-2019-9621-synacor-zimbra-collaboration-suite-ssrf-in-proxyservlet) (critical, exploited in the wild, CVSS 7.5, published 7 Jul 2025) - [CVE-2024-27443: Synacor Zimbra Collaboration Suite XSS in CalendarInvite](https://junglewise.ai/threats/cve-2024-27443-synacor-zimbra-collaboration-suite-xss-in-calendarinvite) (critical, exploited in the wild, CVSS 6.1, published 19 May 2025) - [CVE-2023-34192: Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) Vulnerability](https://junglewise.ai/threats/cve-2023-34192-synacor-zimbra-collaboration-suite-zcs-cross-site-scripting-xss) (critical, exploited in the wild, CVSS 9, published 25 Feb 2025) - [CVE-2024-45519: Synacor Zimbra Collaboration Suite (ZCS) Command Execution Vulnerability](https://junglewise.ai/threats/cve-2024-45519-synacor-zimbra-collaboration-suite-zcs-command-execution) (critical, exploited in the wild, CVSS 9.8, published 3 Oct 2024) - [CVE-2023-37580: Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) Vulnerability](https://junglewise.ai/threats/cve-2023-37580-synacor-zimbra-collaboration-suite-zcs-cross-site-scripting-xss) (critical, exploited in the wild, CVSS 6.1, published 27 Jul 2023) - [CVE-2022-27926: Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) Vulnerability](https://junglewise.ai/threats/cve-2022-27926-synacor-zimbra-collaboration-suite-zcs-cross-site-scripting-xss) (critical, exploited in the wild, CVSS 6.1, published 3 Apr 2023) - [CVE-2022-41352: Synacor Zimbra Collaboration Suite (ZCS) Arbitrary File Upload Vulnerability](https://junglewise.ai/threats/cve-2022-41352-synacor-zimbra-collaboration-suite-zcs-arbitrary-file-upload) (critical, exploited in the wild, CVSS 9.8, published 20 Oct 2022) - [CVE-2022-27925: Synacor Zimbra Collaboration Suite (ZCS) Arbitrary File Upload Vulnerability](https://junglewise.ai/threats/cve-2022-27925-synacor-zimbra-collaboration-suite-zcs-arbitrary-file-upload) (critical, exploited in the wild, CVSS 7.2, published 11 Aug 2022) - [CVE-2022-37042: Synacor Zimbra Collaboration Suite (ZCS) Authentication Bypass Vulnerability](https://junglewise.ai/threats/cve-2022-37042-synacor-zimbra-collaboration-suite-zcs-authentication-bypass) (critical, exploited in the wild, CVSS 9.8, published 11 Aug 2022) - [CVE-2022-27924: Synacor Zimbra Collaboration Suite (ZCS) Command Injection Vulnerability](https://junglewise.ai/threats/cve-2022-27924-synacor-zimbra-collaboration-suite-zcs-command-injection) (critical, exploited in the wild, CVSS 7.5, published 4 Aug 2022) - [CVE-2018-6882: Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) Vulnerability](https://junglewise.ai/threats/cve-2018-6882-synacor-zimbra-collaboration-suite-zcs-cross-site-scripting-xss) (critical, exploited in the wild, CVSS 6.1, published 19 Apr 2022) - [CVE-2022-24682: Synacor Zimbra Collaborate Suite (ZCS) Cross-Site Scripting Vulnerability](https://junglewise.ai/threats/cve-2022-24682-synacor-zimbra-collaborate-suite-zcs-cross-site-scripting) (critical, exploited in the wild, CVSS 6.1, published 25 Feb 2022) - [CVE-2019-9670: Synacor Zimbra Collaboration Suite (ZCS) Improper Restriction of XML External Entity Reference](https://junglewise.ai/threats/cve-2019-9670-synacor-zimbra-collaboration-suite-zcs-improper-restriction-of-xml) (critical, exploited in the wild, CVSS 9.8, published 10 Jan 2022) ## Most severe Synacor Zimbra Collaboration Suite (ZCS) vulnerabilities - [CVE-2020-7796: Synacor Zimbra Collaboration Suite SSRF in WebEx zimlet](https://junglewise.ai/threats/cve-2020-7796-synacor-zimbra-collaboration-suite-ssrf-in-webex-zimlet) (critical, exploited in the wild, CVSS 9.8, published 17 Feb 2026) - [CVE-2026-73570: Zimbra Collaboration Suite OS command injection in SMTP](https://junglewise.ai/threats/cve-2026-73570-zimbra-collaboration-suite-os-command-injection-in-smtp) (critical, exploited in the wild, CVSS 9.8, published 21 Aug 2026) - [CVE-2024-45519: Synacor Zimbra Collaboration Suite (ZCS) Command Execution Vulnerability](https://junglewise.ai/threats/cve-2024-45519-synacor-zimbra-collaboration-suite-zcs-command-execution) (critical, exploited in the wild, CVSS 9.8, published 3 Oct 2024) - [CVE-2022-41352: Synacor Zimbra Collaboration Suite (ZCS) Arbitrary File Upload Vulnerability](https://junglewise.ai/threats/cve-2022-41352-synacor-zimbra-collaboration-suite-zcs-arbitrary-file-upload) (critical, exploited in the wild, CVSS 9.8, published 20 Oct 2022) - [CVE-2022-37042: Synacor Zimbra Collaboration Suite (ZCS) Authentication Bypass Vulnerability](https://junglewise.ai/threats/cve-2022-37042-synacor-zimbra-collaboration-suite-zcs-authentication-bypass) (critical, exploited in the wild, CVSS 9.8, published 11 Aug 2022) - [CVE-2019-9670: Synacor Zimbra Collaboration Suite (ZCS) Improper Restriction of XML External Entity Reference](https://junglewise.ai/threats/cve-2019-9670-synacor-zimbra-collaboration-suite-zcs-improper-restriction-of-xml) (critical, exploited in the wild, CVSS 9.8, published 10 Jan 2022) - [CVE-2023-34192: Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) Vulnerability](https://junglewise.ai/threats/cve-2023-34192-synacor-zimbra-collaboration-suite-zcs-cross-site-scripting-xss) (critical, exploited in the wild, CVSS 9, published 25 Feb 2025) - [CVE-2025-68645: Synacor Zimbra Collaboration Suite file inclusion in RestFilter servlet](https://junglewise.ai/threats/cve-2025-68645-synacor-zimbra-collaboration-suite-file-inclusion-in-restfilter) (critical, exploited in the wild, CVSS 8.8, published 22 Dec 2025) - [CVE-2019-9621: Synacor Zimbra Collaboration Suite SSRF in ProxyServlet](https://junglewise.ai/threats/cve-2019-9621-synacor-zimbra-collaboration-suite-ssrf-in-proxyservlet) (critical, exploited in the wild, CVSS 7.5, published 7 Jul 2025) - [CVE-2022-27924: Synacor Zimbra Collaboration Suite (ZCS) Command Injection Vulnerability](https://junglewise.ai/threats/cve-2022-27924-synacor-zimbra-collaboration-suite-zcs-command-injection) (critical, exploited in the wild, CVSS 7.5, published 4 Aug 2022) ## Vulnerabilities per week Nothing was published in the last eight weeks. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 1 | 1 | 1 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 0 | 0 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 0 | 0 | 0 | | 19 Oct 2026 | 0 | 0 | 0 | | 26 Oct 2026 | 0 | 0 | 0 | | 2 Nov 2026 | 0 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## Other Synacor technologies - [Synacor Zimbra Collaboration Suite](https://junglewise.ai/threats/technologies/zimbra-collaboration-suite): 24 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "Synacor Zimbra Collaboration Suite (ZCS) vulnerabilities", https://junglewise.ai/threats/technologies/zimbra-collaboration-suite-zcs, 9 November 2026.