{"schema_version":1,"title":"Synacor Zimbra Collaboration Suite vulnerabilities","summary":"Junglewise Threat Intelligence has tracked 24 vulnerabilities in Synacor Zimbra Collaboration Suite: 0 in the last 7 days and 0 in the last 90 days, 9 of them critical and 8 exploited in the wild. The most recent, CVE-2025-48700, was published on 20 April 2026.","url":"https://junglewise.ai/threats/technologies/zimbra-collaboration-suite","json_url":"https://junglewise.ai/threats/technologies/zimbra-collaboration-suite.json","publisher":"Junglewise Threat Intelligence","license":"CC-BY-4.0","license_url":"https://creativecommons.org/licenses/by/4.0/","attribution":"Junglewise Threat Intelligence, https://junglewise.ai/threats/technologies/zimbra-collaboration-suite","sources":"NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories","kind":"technology","counts":{"high":6,"all_time":24,"critical":9,"exploited":8,"last_7_days":0,"last_30_days":0,"last_90_days":0,"last_365_days":5},"latest":[{"cve":"CVE-2025-48700","cvss":6.1,"epss":0.1876,"slug":"cve-2025-48700-synacor-zimbra-collaboration-suite-xss-in-classic-ui","title":"Synacor Zimbra Collaboration Suite XSS in Classic UI","severity":"critical","exploited":true,"published_at":"2026-04-20T00:00:00+00:00","url":"https://junglewise.ai/threats/cve-2025-48700-synacor-zimbra-collaboration-suite-xss-in-classic-ui"},{"cve":"CVE-2025-66376","cvss":7.2,"epss":0.109,"slug":"cve-2025-66376-synacor-zimbra-collaboration-suite-stored-xss-in-classic-ui","title":"Synacor Zimbra Collaboration Suite stored XSS in Classic UI","severity":"critical","exploited":true,"published_at":"2026-03-18T00:00:00+00:00","url":"https://junglewise.ai/threats/cve-2025-66376-synacor-zimbra-collaboration-suite-stored-xss-in-classic-ui"},{"cve":"CVE-2020-7796","cvss":9.8,"epss":0.9269,"slug":"cve-2020-7796-synacor-zimbra-collaboration-suite-ssrf-in-webex-zimlet","title":"Synacor Zimbra Collaboration Suite SSRF in WebEx zimlet","severity":"critical","exploited":true,"published_at":"2026-02-17T00:00:00+00:00","url":"https://junglewise.ai/threats/cve-2020-7796-synacor-zimbra-collaboration-suite-ssrf-in-webex-zimlet"},{"cve":"CVE-2025-68645","cvss":8.8,"epss":0.4771,"slug":"cve-2025-68645-synacor-zimbra-collaboration-suite-file-inclusion-in-restfilter","title":"Synacor Zimbra Collaboration Suite file inclusion in RestFilter servlet","severity":"critical","exploited":true,"published_at":"2026-01-22T00:00:00+00:00","url":"https://junglewise.ai/threats/cve-2025-68645-synacor-zimbra-collaboration-suite-file-inclusion-in-restfilter"},{"cve":"CVE-2025-27915","cvss":5.4,"epss":0.2605,"slug":"cve-2025-27915-synacor-zimbra-collaboration-suite-xss-in-classic-web-client","title":"Synacor Zimbra Collaboration Suite XSS in Classic Web Client","severity":"critical","exploited":true,"published_at":"2025-10-07T00:00:00+00:00","url":"https://junglewise.ai/threats/cve-2025-27915-synacor-zimbra-collaboration-suite-xss-in-classic-web-client"},{"cve":"CVE-2019-9621","cvss":7.5,"epss":0.9411,"slug":"cve-2019-9621-synacor-zimbra-collaboration-suite-ssrf-in-proxyservlet","title":"Synacor Zimbra Collaboration Suite SSRF in ProxyServlet","severity":"critical","exploited":true,"published_at":"2025-07-07T00:00:00+00:00","url":"https://junglewise.ai/threats/cve-2019-9621-synacor-zimbra-collaboration-suite-ssrf-in-proxyservlet"},{"cve":"CVE-2024-27443","cvss":6.1,"epss":0.3243,"slug":"cve-2024-27443-synacor-zimbra-collaboration-suite-xss-in-calendarinvite","title":"Synacor Zimbra Collaboration Suite XSS in CalendarInvite","severity":"critical","exploited":true,"published_at":"2025-05-19T00:00:00+00:00","url":"https://junglewise.ai/threats/cve-2024-27443-synacor-zimbra-collaboration-suite-xss-in-calendarinvite"},{"cve":"CVE-2019-9670","cvss":9.8,"slug":"cve-2019-9670-synacor-zimbra-collaboration-suite-zcs-improper-restriction-of-xml","title":"Synacor Zimbra Collaboration Suite (ZCS) Improper Restriction of XML External Entity Reference","severity":"critical","exploited":true,"published_at":"2022-01-10T00:00:00+00:00","url":"https://junglewise.ai/threats/cve-2019-9670-synacor-zimbra-collaboration-suite-zcs-improper-restriction-of-xml"},{"cve":"CVE-2016-4019","cvss":7.5,"slug":"cve-2016-4019-zimbra-collaboration-suite-integrity-vulnerability-via-unknown","title":"Zimbra Collaboration Suite integrity vulnerability via unknown vectors","severity":"high","exploited":false,"published_at":"2017-01-18T22:59:00.75+00:00","url":"https://junglewise.ai/threats/cve-2016-4019-zimbra-collaboration-suite-integrity-vulnerability-via-unknown"},{"cve":"CVE-2016-3999","cvss":6.1,"slug":"cve-2016-3999-zimbra-collaboration-multiple-xss-vulnerabilities","title":"Zimbra Collaboration multiple XSS vulnerabilities","severity":"medium","exploited":false,"published_at":"2017-01-18T22:59:00.703+00:00","url":"https://junglewise.ai/threats/cve-2016-3999-zimbra-collaboration-multiple-xss-vulnerabilities"},{"cve":"CVE-2016-3415","cvss":9.1,"slug":"cve-2016-3415-zimbra-collaboration-deserialization-attack-via-unspecified","title":"Zimbra Collaboration deserialization attack via unspecified vectors","severity":"critical","exploited":false,"published_at":"2017-01-18T22:59:00.67+00:00","url":"https://junglewise.ai/threats/cve-2016-3415-zimbra-collaboration-deserialization-attack-via-unspecified"},{"cve":"CVE-2016-3414","cvss":6.5,"slug":"cve-2016-3414-zimbra-collaboration-denial-of-service-in-mailboxd","title":"Zimbra Collaboration denial of service in mailboxd","severity":"medium","exploited":false,"published_at":"2017-01-18T22:59:00.623+00:00","url":"https://junglewise.ai/threats/cve-2016-3414-zimbra-collaboration-denial-of-service-in-mailboxd"},{"cve":"CVE-2016-3413","cvss":7.5,"slug":"cve-2016-3413-zimbra-collaboration-integrity-vulnerability-via-unknown-vectors","title":"Zimbra Collaboration integrity vulnerability via unknown vectors","severity":"high","exploited":false,"published_at":"2017-01-18T22:59:00.593+00:00","url":"https://junglewise.ai/threats/cve-2016-3413-zimbra-collaboration-integrity-vulnerability-via-unknown-vectors"},{"cve":"CVE-2016-3412","cvss":6.1,"slug":"cve-2016-3412-zimbra-collaboration-multiple-xss-vulnerabilities","title":"Zimbra Collaboration Multiple XSS Vulnerabilities","severity":"medium","exploited":false,"published_at":"2017-01-18T22:59:00.563+00:00","url":"https://junglewise.ai/threats/cve-2016-3412-zimbra-collaboration-multiple-xss-vulnerabilities"},{"cve":"CVE-2016-3411","cvss":6.1,"slug":"cve-2016-3411-zimbra-collaboration-xss-in-changepass-component","title":"Zimbra Collaboration XSS in changepass component","severity":"medium","exploited":false,"published_at":"2017-01-18T22:59:00.53+00:00","url":"https://junglewise.ai/threats/cve-2016-3411-zimbra-collaboration-xss-in-changepass-component"},{"cve":"CVE-2016-3410","cvss":6.1,"slug":"cve-2016-3410-zimbra-collaboration-multiple-xss-vulnerabilities","title":"Zimbra Collaboration multiple XSS vulnerabilities","severity":"medium","exploited":false,"published_at":"2017-01-18T22:59:00.5+00:00","url":"https://junglewise.ai/threats/cve-2016-3410-zimbra-collaboration-multiple-xss-vulnerabilities"},{"cve":"CVE-2016-3409","cvss":6.1,"slug":"cve-2016-3409-zimbra-collaboration-xss-in-unspecified-components","title":"Zimbra Collaboration XSS in unspecified components","severity":"medium","exploited":false,"published_at":"2017-01-18T22:59:00.467+00:00","url":"https://junglewise.ai/threats/cve-2016-3409-zimbra-collaboration-xss-in-unspecified-components"},{"cve":"CVE-2016-3408","cvss":6.1,"slug":"cve-2016-3408-zimbra-collaboration-xss-in-unspecified-component","title":"Zimbra Collaboration XSS in unspecified component","severity":"medium","exploited":false,"published_at":"2017-01-18T22:59:00.42+00:00","url":"https://junglewise.ai/threats/cve-2016-3408-zimbra-collaboration-xss-in-unspecified-component"},{"cve":"CVE-2016-3407","cvss":6.1,"slug":"cve-2016-3407-zimbra-collaboration-multiple-xss-vulnerabilities","title":"Zimbra Collaboration multiple XSS vulnerabilities","severity":"medium","exploited":false,"published_at":"2017-01-18T22:59:00.39+00:00","url":"https://junglewise.ai/threats/cve-2016-3407-zimbra-collaboration-multiple-xss-vulnerabilities"},{"cve":"CVE-2016-3406","cvss":8.8,"slug":"cve-2016-3406-zimbra-collaboration-csrf-in-client-uploader-and-rest-handlers","title":"Zimbra Collaboration CSRF in Client uploader and REST handlers","severity":"high","exploited":false,"published_at":"2017-01-18T22:59:00.343+00:00","url":"https://junglewise.ai/threats/cve-2016-3406-zimbra-collaboration-csrf-in-client-uploader-and-rest-handlers"},{"cve":"CVE-2016-3405","cvss":7.5,"slug":"cve-2016-3405-zimbra-collaboration-multiple-unspecified-vulnerabilities","title":"Zimbra Collaboration multiple unspecified vulnerabilities","severity":"high","exploited":false,"published_at":"2017-01-18T22:59:00.313+00:00","url":"https://junglewise.ai/threats/cve-2016-3405-zimbra-collaboration-multiple-unspecified-vulnerabilities"},{"cve":"CVE-2016-3404","cvss":7.5,"slug":"cve-2016-3404-zimbra-collaboration-integrity-vulnerability-via-unknown-vectors","title":"Zimbra Collaboration integrity vulnerability via unknown vectors","severity":"high","exploited":false,"published_at":"2017-01-18T22:59:00.28+00:00","url":"https://junglewise.ai/threats/cve-2016-3404-zimbra-collaboration-integrity-vulnerability-via-unknown-vectors"},{"cve":"CVE-2016-3402","cvss":7.5,"slug":"cve-2016-3402-zimbra-collaboration-unspecified-confidentiality-vulnerability","title":"Zimbra Collaboration unspecified confidentiality vulnerability","severity":"high","exploited":false,"published_at":"2017-01-18T22:59:00.25+00:00","url":"https://junglewise.ai/threats/cve-2016-3402-zimbra-collaboration-unspecified-confidentiality-vulnerability"},{"cve":"CVE-2016-3401","cvss":6.5,"slug":"cve-2016-3401-zimbra-collaboration-integrity-vulnerability-via-unknown-vectors","title":"Zimbra Collaboration integrity vulnerability via unknown vectors","severity":"medium","exploited":false,"published_at":"2017-01-18T22:59:00.203+00:00","url":"https://junglewise.ai/threats/cve-2016-3401-zimbra-collaboration-integrity-vulnerability-via-unknown-vectors"}],"weekly":[{"week":"2026-06-29","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-06","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-13","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-20","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-27","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-03","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-10","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-17","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-24","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-31","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-07","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-14","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-21","critical":0,"exploited":0,"vulnerabilities":0}],"related":[{"name":"Synacor Zimbra Collaboration Suite (ZCS)","slug":"zimbra-collaboration-suite-zcs","vulnerabilities":19,"url":"https://junglewise.ai/threats/technologies/zimbra-collaboration-suite-zcs"}],"technology":{"hub":true,"name":"Synacor Zimbra Collaboration Suite","slug":"zimbra-collaboration-suite","vendor":{"name":"Synacor","slug":"synacor","url":"https://junglewise.ai/threats/vendors/synacor"},"aliases":[],"category":"application","homepage":"https://www.zimbra.com/","repo_url":"https://github.com/Zimbra/zm-build","description":"An enterprise-grade email and collaboration platform that includes contacts, calendar, and file sharing capabilities.","url":"https://junglewise.ai/threats/technologies/zimbra-collaboration-suite"},"most_severe":[{"cve":"CVE-2020-7796","cvss":9.8,"epss":0.9269,"slug":"cve-2020-7796-synacor-zimbra-collaboration-suite-ssrf-in-webex-zimlet","title":"Synacor Zimbra Collaboration Suite SSRF in WebEx zimlet","severity":"critical","exploited":true,"published_at":"2026-02-17T00:00:00+00:00","url":"https://junglewise.ai/threats/cve-2020-7796-synacor-zimbra-collaboration-suite-ssrf-in-webex-zimlet"},{"cve":"CVE-2019-9670","cvss":9.8,"slug":"cve-2019-9670-synacor-zimbra-collaboration-suite-zcs-improper-restriction-of-xml","title":"Synacor Zimbra Collaboration Suite (ZCS) Improper Restriction of XML External Entity Reference","severity":"critical","exploited":true,"published_at":"2022-01-10T00:00:00+00:00","url":"https://junglewise.ai/threats/cve-2019-9670-synacor-zimbra-collaboration-suite-zcs-improper-restriction-of-xml"},{"cve":"CVE-2025-68645","cvss":8.8,"epss":0.4771,"slug":"cve-2025-68645-synacor-zimbra-collaboration-suite-file-inclusion-in-restfilter","title":"Synacor Zimbra Collaboration Suite file inclusion in RestFilter servlet","severity":"critical","exploited":true,"published_at":"2026-01-22T00:00:00+00:00","url":"https://junglewise.ai/threats/cve-2025-68645-synacor-zimbra-collaboration-suite-file-inclusion-in-restfilter"},{"cve":"CVE-2019-9621","cvss":7.5,"epss":0.9411,"slug":"cve-2019-9621-synacor-zimbra-collaboration-suite-ssrf-in-proxyservlet","title":"Synacor Zimbra Collaboration Suite SSRF in ProxyServlet","severity":"critical","exploited":true,"published_at":"2025-07-07T00:00:00+00:00","url":"https://junglewise.ai/threats/cve-2019-9621-synacor-zimbra-collaboration-suite-ssrf-in-proxyservlet"},{"cve":"CVE-2025-66376","cvss":7.2,"epss":0.109,"slug":"cve-2025-66376-synacor-zimbra-collaboration-suite-stored-xss-in-classic-ui","title":"Synacor Zimbra Collaboration Suite stored XSS in Classic UI","severity":"critical","exploited":true,"published_at":"2026-03-18T00:00:00+00:00","url":"https://junglewise.ai/threats/cve-2025-66376-synacor-zimbra-collaboration-suite-stored-xss-in-classic-ui"},{"cve":"CVE-2024-27443","cvss":6.1,"epss":0.3243,"slug":"cve-2024-27443-synacor-zimbra-collaboration-suite-xss-in-calendarinvite","title":"Synacor Zimbra Collaboration Suite XSS in CalendarInvite","severity":"critical","exploited":true,"published_at":"2025-05-19T00:00:00+00:00","url":"https://junglewise.ai/threats/cve-2024-27443-synacor-zimbra-collaboration-suite-xss-in-calendarinvite"},{"cve":"CVE-2025-48700","cvss":6.1,"epss":0.1876,"slug":"cve-2025-48700-synacor-zimbra-collaboration-suite-xss-in-classic-ui","title":"Synacor Zimbra Collaboration Suite XSS in Classic UI","severity":"critical","exploited":true,"published_at":"2026-04-20T00:00:00+00:00","url":"https://junglewise.ai/threats/cve-2025-48700-synacor-zimbra-collaboration-suite-xss-in-classic-ui"},{"cve":"CVE-2025-27915","cvss":5.4,"epss":0.2605,"slug":"cve-2025-27915-synacor-zimbra-collaboration-suite-xss-in-classic-web-client","title":"Synacor Zimbra Collaboration Suite XSS in Classic Web Client","severity":"critical","exploited":true,"published_at":"2025-10-07T00:00:00+00:00","url":"https://junglewise.ai/threats/cve-2025-27915-synacor-zimbra-collaboration-suite-xss-in-classic-web-client"},{"cve":"CVE-2016-3415","cvss":9.1,"slug":"cve-2016-3415-zimbra-collaboration-deserialization-attack-via-unspecified","title":"Zimbra Collaboration deserialization attack via unspecified vectors","severity":"critical","exploited":false,"published_at":"2017-01-18T22:59:00.67+00:00","url":"https://junglewise.ai/threats/cve-2016-3415-zimbra-collaboration-deserialization-attack-via-unspecified"},{"cve":"CVE-2016-3406","cvss":8.8,"slug":"cve-2016-3406-zimbra-collaboration-csrf-in-client-uploader-and-rest-handlers","title":"Zimbra Collaboration CSRF in Client uploader and REST handlers","severity":"high","exploited":false,"published_at":"2017-01-18T22:59:00.343+00:00","url":"https://junglewise.ai/threats/cve-2016-3406-zimbra-collaboration-csrf-in-client-uploader-and-rest-handlers"}],"generated_at":"2026-09-26T09:11:00.170868+00:00"}