# Synacor Zimbra Collaboration Suite vulnerabilities

Source: https://junglewise.ai/threats/technologies/zimbra-collaboration-suite  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Updated: 9 November 2026, 03:07 UTC. Rebuilt every hour.  
Data: https://junglewise.ai/threats/technologies/zimbra-collaboration-suite.json  
License: CC BY 4.0 with a link back

Junglewise Threat Intelligence has tracked 24 vulnerabilities in Synacor Zimbra Collaboration Suite: 0 in the last 7 days and 0 in the last 90 days, 9 of them critical and 8 exploited in the wild. The most recent, CVE-2025-48700, was published on 20 April 2026.

## Counts

- Last 7 days: 0
- Last 30 days: 0
- Last 90 days: 0
- All time: 24 (9 critical, 8 exploited in the wild)

## About Synacor Zimbra Collaboration Suite

An enterprise-grade email and collaboration platform that includes contacts, calendar, and file sharing capabilities.

## Latest Synacor Zimbra Collaboration Suite vulnerabilities

- [CVE-2025-48700: Synacor Zimbra Collaboration Suite XSS in Classic UI](https://junglewise.ai/threats/cve-2025-48700-synacor-zimbra-collaboration-suite-xss-in-classic-ui) (critical, exploited in the wild, CVSS 6.1, published 20 Apr 2026)
- [CVE-2020-7796: Synacor Zimbra Collaboration Suite SSRF in WebEx zimlet](https://junglewise.ai/threats/cve-2020-7796-synacor-zimbra-collaboration-suite-ssrf-in-webex-zimlet) (critical, exploited in the wild, CVSS 9.8, published 17 Feb 2026)
- [CVE-2025-66376: Synacor Zimbra Collaboration Suite stored XSS in Classic UI](https://junglewise.ai/threats/cve-2025-66376-synacor-zimbra-collaboration-suite-stored-xss-in-classic-ui) (critical, exploited in the wild, CVSS 7.2, published 5 Jan 2026)
- [CVE-2025-68645: Synacor Zimbra Collaboration Suite file inclusion in RestFilter servlet](https://junglewise.ai/threats/cve-2025-68645-synacor-zimbra-collaboration-suite-file-inclusion-in-restfilter) (critical, exploited in the wild, CVSS 8.8, published 22 Dec 2025)
- [CVE-2025-27915: Synacor Zimbra Collaboration Suite XSS in Classic Web Client](https://junglewise.ai/threats/cve-2025-27915-synacor-zimbra-collaboration-suite-xss-in-classic-web-client) (critical, exploited in the wild, CVSS 5.4, published 7 Oct 2025)
- [CVE-2019-9621: Synacor Zimbra Collaboration Suite SSRF in ProxyServlet](https://junglewise.ai/threats/cve-2019-9621-synacor-zimbra-collaboration-suite-ssrf-in-proxyservlet) (critical, exploited in the wild, CVSS 7.5, published 7 Jul 2025)
- [CVE-2024-27443: Synacor Zimbra Collaboration Suite XSS in CalendarInvite](https://junglewise.ai/threats/cve-2024-27443-synacor-zimbra-collaboration-suite-xss-in-calendarinvite) (critical, exploited in the wild, CVSS 6.1, published 19 May 2025)
- [CVE-2019-9670: Synacor Zimbra Collaboration Suite (ZCS) Improper Restriction of XML External Entity Reference](https://junglewise.ai/threats/cve-2019-9670-synacor-zimbra-collaboration-suite-zcs-improper-restriction-of-xml) (critical, exploited in the wild, CVSS 9.8, published 10 Jan 2022)
- [CVE-2016-4019: Zimbra Collaboration Suite integrity vulnerability via unknown vectors](https://junglewise.ai/threats/cve-2016-4019-zimbra-collaboration-suite-integrity-vulnerability-via-unknown) (high, CVSS 7.5, published 18 Jan 2017)
- [CVE-2016-3999: Zimbra Collaboration multiple XSS vulnerabilities](https://junglewise.ai/threats/cve-2016-3999-zimbra-collaboration-multiple-xss-vulnerabilities) (medium, CVSS 6.1, published 18 Jan 2017)
- [CVE-2016-3415: Zimbra Collaboration deserialization attack via unspecified vectors](https://junglewise.ai/threats/cve-2016-3415-zimbra-collaboration-deserialization-attack-via-unspecified) (critical, CVSS 9.1, published 18 Jan 2017)
- [CVE-2016-3414: Zimbra Collaboration denial of service in mailboxd](https://junglewise.ai/threats/cve-2016-3414-zimbra-collaboration-denial-of-service-in-mailboxd) (medium, CVSS 6.5, published 18 Jan 2017)
- [CVE-2016-3413: Zimbra Collaboration integrity vulnerability via unknown vectors](https://junglewise.ai/threats/cve-2016-3413-zimbra-collaboration-integrity-vulnerability-via-unknown-vectors) (high, CVSS 7.5, published 18 Jan 2017)
- [CVE-2016-3412: Zimbra Collaboration Multiple XSS Vulnerabilities](https://junglewise.ai/threats/cve-2016-3412-zimbra-collaboration-multiple-xss-vulnerabilities) (medium, CVSS 6.1, published 18 Jan 2017)
- [CVE-2016-3411: Zimbra Collaboration XSS in changepass component](https://junglewise.ai/threats/cve-2016-3411-zimbra-collaboration-xss-in-changepass-component) (medium, CVSS 6.1, published 18 Jan 2017)
- [CVE-2016-3410: Zimbra Collaboration multiple XSS vulnerabilities](https://junglewise.ai/threats/cve-2016-3410-zimbra-collaboration-multiple-xss-vulnerabilities) (medium, CVSS 6.1, published 18 Jan 2017)
- [CVE-2016-3409: Zimbra Collaboration XSS in unspecified components](https://junglewise.ai/threats/cve-2016-3409-zimbra-collaboration-xss-in-unspecified-components) (medium, CVSS 6.1, published 18 Jan 2017)
- [CVE-2016-3408: Zimbra Collaboration XSS in unspecified component](https://junglewise.ai/threats/cve-2016-3408-zimbra-collaboration-xss-in-unspecified-component) (medium, CVSS 6.1, published 18 Jan 2017)
- [CVE-2016-3407: Zimbra Collaboration multiple XSS vulnerabilities](https://junglewise.ai/threats/cve-2016-3407-zimbra-collaboration-multiple-xss-vulnerabilities) (medium, CVSS 6.1, published 18 Jan 2017)
- [CVE-2016-3406: Zimbra Collaboration CSRF in Client uploader and REST handlers](https://junglewise.ai/threats/cve-2016-3406-zimbra-collaboration-csrf-in-client-uploader-and-rest-handlers) (high, CVSS 8.8, published 18 Jan 2017)
- [CVE-2016-3405: Zimbra Collaboration multiple unspecified vulnerabilities](https://junglewise.ai/threats/cve-2016-3405-zimbra-collaboration-multiple-unspecified-vulnerabilities) (high, CVSS 7.5, published 18 Jan 2017)
- [CVE-2016-3404: Zimbra Collaboration integrity vulnerability via unknown vectors](https://junglewise.ai/threats/cve-2016-3404-zimbra-collaboration-integrity-vulnerability-via-unknown-vectors) (high, CVSS 7.5, published 18 Jan 2017)
- [CVE-2016-3402: Zimbra Collaboration unspecified confidentiality vulnerability](https://junglewise.ai/threats/cve-2016-3402-zimbra-collaboration-unspecified-confidentiality-vulnerability) (high, CVSS 7.5, published 18 Jan 2017)
- [CVE-2016-3401: Zimbra Collaboration integrity vulnerability via unknown vectors](https://junglewise.ai/threats/cve-2016-3401-zimbra-collaboration-integrity-vulnerability-via-unknown-vectors) (medium, CVSS 6.5, published 18 Jan 2017)

## Most severe Synacor Zimbra Collaboration Suite vulnerabilities

- [CVE-2020-7796: Synacor Zimbra Collaboration Suite SSRF in WebEx zimlet](https://junglewise.ai/threats/cve-2020-7796-synacor-zimbra-collaboration-suite-ssrf-in-webex-zimlet) (critical, exploited in the wild, CVSS 9.8, published 17 Feb 2026)
- [CVE-2019-9670: Synacor Zimbra Collaboration Suite (ZCS) Improper Restriction of XML External Entity Reference](https://junglewise.ai/threats/cve-2019-9670-synacor-zimbra-collaboration-suite-zcs-improper-restriction-of-xml) (critical, exploited in the wild, CVSS 9.8, published 10 Jan 2022)
- [CVE-2025-68645: Synacor Zimbra Collaboration Suite file inclusion in RestFilter servlet](https://junglewise.ai/threats/cve-2025-68645-synacor-zimbra-collaboration-suite-file-inclusion-in-restfilter) (critical, exploited in the wild, CVSS 8.8, published 22 Dec 2025)
- [CVE-2019-9621: Synacor Zimbra Collaboration Suite SSRF in ProxyServlet](https://junglewise.ai/threats/cve-2019-9621-synacor-zimbra-collaboration-suite-ssrf-in-proxyservlet) (critical, exploited in the wild, CVSS 7.5, published 7 Jul 2025)
- [CVE-2025-66376: Synacor Zimbra Collaboration Suite stored XSS in Classic UI](https://junglewise.ai/threats/cve-2025-66376-synacor-zimbra-collaboration-suite-stored-xss-in-classic-ui) (critical, exploited in the wild, CVSS 7.2, published 5 Jan 2026)
- [CVE-2024-27443: Synacor Zimbra Collaboration Suite XSS in CalendarInvite](https://junglewise.ai/threats/cve-2024-27443-synacor-zimbra-collaboration-suite-xss-in-calendarinvite) (critical, exploited in the wild, CVSS 6.1, published 19 May 2025)
- [CVE-2025-48700: Synacor Zimbra Collaboration Suite XSS in Classic UI](https://junglewise.ai/threats/cve-2025-48700-synacor-zimbra-collaboration-suite-xss-in-classic-ui) (critical, exploited in the wild, CVSS 6.1, published 20 Apr 2026)
- [CVE-2025-27915: Synacor Zimbra Collaboration Suite XSS in Classic Web Client](https://junglewise.ai/threats/cve-2025-27915-synacor-zimbra-collaboration-suite-xss-in-classic-web-client) (critical, exploited in the wild, CVSS 5.4, published 7 Oct 2025)
- [CVE-2016-3415: Zimbra Collaboration deserialization attack via unspecified vectors](https://junglewise.ai/threats/cve-2016-3415-zimbra-collaboration-deserialization-attack-via-unspecified) (critical, CVSS 9.1, published 18 Jan 2017)
- [CVE-2016-3406: Zimbra Collaboration CSRF in Client uploader and REST handlers](https://junglewise.ai/threats/cve-2016-3406-zimbra-collaboration-csrf-in-client-uploader-and-rest-handlers) (high, CVSS 8.8, published 18 Jan 2017)

## Vulnerabilities per week

Nothing was published in the last eight weeks.

| Week of | Vulns | Critical | Exploited |
| --- | --- | --- | --- |
| 17 Aug 2026 | 0 | 0 | 0 |
| 24 Aug 2026 | 0 | 0 | 0 |
| 31 Aug 2026 | 0 | 0 | 0 |
| 7 Sep 2026 | 0 | 0 | 0 |
| 14 Sep 2026 | 0 | 0 | 0 |
| 21 Sep 2026 | 0 | 0 | 0 |
| 28 Sep 2026 | 0 | 0 | 0 |
| 5 Oct 2026 | 0 | 0 | 0 |
| 12 Oct 2026 | 0 | 0 | 0 |
| 19 Oct 2026 | 0 | 0 | 0 |
| 26 Oct 2026 | 0 | 0 | 0 |
| 2 Nov 2026 | 0 | 0 | 0 |
| 9 Nov 2026 | 0 | 0 | 0 |

## Other Synacor technologies

- [Synacor Zimbra Collaboration Suite (ZCS)](https://junglewise.ai/threats/technologies/zimbra-collaboration-suite-zcs): 19 vulnerabilities

## Sources

NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "Synacor Zimbra Collaboration Suite vulnerabilities", https://junglewise.ai/threats/technologies/zimbra-collaboration-suite, 9 November 2026.