# Synacor vulnerabilities Source: https://junglewise.ai/threats/vendors/synacor Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 12 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/vendors/synacor.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 37 vulnerabilities in Synacor: 0 in the last 7 days and 3 in the last 90 days, 20 of them critical and 19 exploited in the wild. The most recent, CVE-2026-66912, was published on 29 October 2026. 2 vulnerabilities in the last four weeks, up from none in the four before. 2 technologies have a page of their own. ## Counts - Last 7 days: 0 - Last 30 days: 2 - Last 90 days: 3 - All time: 37 (20 critical, 19 exploited in the wild) ## About Synacor Software company providing cloud-based platforms for communications, identity, and web services. ## Latest Synacor vulnerabilities - [CVE-2026-66912: Zimbra Collaboration stored XSS in From header during reply composition](https://junglewise.ai/threats/cve-2026-66912-zimbra-is-vulnerable-to-stored-cross-site-scripting-xss-via-the) (info, published 29 Oct 2026) - [CVE-2026-66911: Zimbra stored XSS via Content-Location MIME header in attachments](https://junglewise.ai/threats/cve-2026-66911-zimbra-is-vulnerable-to-stored-cross-site-scripting-xss-via-the) (info, published 29 Oct 2026) - [CVE-2026-73570: Zimbra Collaboration Suite OS command injection in SMTP](https://junglewise.ai/threats/cve-2026-73570-zimbra-collaboration-suite-os-command-injection-in-smtp) (critical, exploited in the wild, CVSS 9.8, published 21 Aug 2026) - [CVE-2025-48700: Synacor Zimbra Collaboration Suite XSS in Classic UI](https://junglewise.ai/threats/cve-2025-48700-synacor-zimbra-collaboration-suite-xss-in-classic-ui) (critical, exploited in the wild, CVSS 6.1, published 20 Apr 2026) - [CVE-2020-7796: Synacor Zimbra Collaboration Suite SSRF in WebEx zimlet](https://junglewise.ai/threats/cve-2020-7796-synacor-zimbra-collaboration-suite-ssrf-in-webex-zimlet) (critical, exploited in the wild, CVSS 9.8, published 17 Feb 2026) - [CVE-2025-66376: Synacor Zimbra Collaboration Suite stored XSS in Classic UI](https://junglewise.ai/threats/cve-2025-66376-synacor-zimbra-collaboration-suite-stored-xss-in-classic-ui) (critical, exploited in the wild, CVSS 7.2, published 5 Jan 2026) - [CVE-2025-68645: Synacor Zimbra Collaboration Suite file inclusion in RestFilter servlet](https://junglewise.ai/threats/cve-2025-68645-synacor-zimbra-collaboration-suite-file-inclusion-in-restfilter) (critical, exploited in the wild, CVSS 8.8, published 22 Dec 2025) - [CVE-2025-27915: Synacor Zimbra Collaboration Suite XSS in Classic Web Client](https://junglewise.ai/threats/cve-2025-27915-synacor-zimbra-collaboration-suite-xss-in-classic-web-client) (critical, exploited in the wild, CVSS 5.4, published 7 Oct 2025) - [CVE-2019-9621: Synacor Zimbra Collaboration Suite SSRF in ProxyServlet](https://junglewise.ai/threats/cve-2019-9621-synacor-zimbra-collaboration-suite-ssrf-in-proxyservlet) (critical, exploited in the wild, CVSS 7.5, published 7 Jul 2025) - [CVE-2024-27443: Synacor Zimbra Collaboration Suite XSS in CalendarInvite](https://junglewise.ai/threats/cve-2024-27443-synacor-zimbra-collaboration-suite-xss-in-calendarinvite) (critical, exploited in the wild, CVSS 6.1, published 19 May 2025) - [CVE-2023-34192: Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) Vulnerability](https://junglewise.ai/threats/cve-2023-34192-synacor-zimbra-collaboration-suite-zcs-cross-site-scripting-xss) (critical, exploited in the wild, CVSS 9, published 25 Feb 2025) - [CVE-2024-45519: Synacor Zimbra Collaboration Suite (ZCS) Command Execution Vulnerability](https://junglewise.ai/threats/cve-2024-45519-synacor-zimbra-collaboration-suite-zcs-command-execution) (critical, exploited in the wild, CVSS 9.8, published 3 Oct 2024) - [CVE-2023-37580: Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) Vulnerability](https://junglewise.ai/threats/cve-2023-37580-synacor-zimbra-collaboration-suite-zcs-cross-site-scripting-xss) (critical, exploited in the wild, CVSS 6.1, published 27 Jul 2023) - [CVE-2022-27926: Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) Vulnerability](https://junglewise.ai/threats/cve-2022-27926-synacor-zimbra-collaboration-suite-zcs-cross-site-scripting-xss) (critical, exploited in the wild, CVSS 6.1, published 3 Apr 2023) - [CVE-2022-41352: Synacor Zimbra Collaboration Suite (ZCS) Arbitrary File Upload Vulnerability](https://junglewise.ai/threats/cve-2022-41352-synacor-zimbra-collaboration-suite-zcs-arbitrary-file-upload) (critical, exploited in the wild, CVSS 9.8, published 20 Oct 2022) - [CVE-2022-27925: Synacor Zimbra Collaboration Suite (ZCS) Arbitrary File Upload Vulnerability](https://junglewise.ai/threats/cve-2022-27925-synacor-zimbra-collaboration-suite-zcs-arbitrary-file-upload) (critical, exploited in the wild, CVSS 7.2, published 11 Aug 2022) - [CVE-2022-37042: Synacor Zimbra Collaboration Suite (ZCS) Authentication Bypass Vulnerability](https://junglewise.ai/threats/cve-2022-37042-synacor-zimbra-collaboration-suite-zcs-authentication-bypass) (critical, exploited in the wild, CVSS 9.8, published 11 Aug 2022) - [CVE-2022-27924: Synacor Zimbra Collaboration Suite (ZCS) Command Injection Vulnerability](https://junglewise.ai/threats/cve-2022-27924-synacor-zimbra-collaboration-suite-zcs-command-injection) (critical, exploited in the wild, CVSS 7.5, published 4 Aug 2022) - [CVE-2018-6882: Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) Vulnerability](https://junglewise.ai/threats/cve-2018-6882-synacor-zimbra-collaboration-suite-zcs-cross-site-scripting-xss) (critical, exploited in the wild, CVSS 6.1, published 19 Apr 2022) - [CVE-2022-24682: Synacor Zimbra Collaborate Suite (ZCS) Cross-Site Scripting Vulnerability](https://junglewise.ai/threats/cve-2022-24682-synacor-zimbra-collaborate-suite-zcs-cross-site-scripting) (critical, exploited in the wild, CVSS 6.1, published 25 Feb 2022) - [CVE-2019-9670: Synacor Zimbra Collaboration Suite (ZCS) Improper Restriction of XML External Entity Reference](https://junglewise.ai/threats/cve-2019-9670-synacor-zimbra-collaboration-suite-zcs-improper-restriction-of-xml) (critical, exploited in the wild, CVSS 9.8, published 10 Jan 2022) - [CVE-2016-4019: Zimbra Collaboration Suite integrity vulnerability via unknown vectors](https://junglewise.ai/threats/cve-2016-4019-zimbra-collaboration-suite-integrity-vulnerability-via-unknown) (high, CVSS 7.5, published 18 Jan 2017) - [CVE-2016-3999: Zimbra Collaboration multiple XSS vulnerabilities](https://junglewise.ai/threats/cve-2016-3999-zimbra-collaboration-multiple-xss-vulnerabilities) (medium, CVSS 6.1, published 18 Jan 2017) - [CVE-2016-3415: Zimbra Collaboration deserialization attack via unspecified vectors](https://junglewise.ai/threats/cve-2016-3415-zimbra-collaboration-deserialization-attack-via-unspecified) (critical, CVSS 9.1, published 18 Jan 2017) - [CVE-2016-3414: Zimbra Collaboration denial of service in mailboxd](https://junglewise.ai/threats/cve-2016-3414-zimbra-collaboration-denial-of-service-in-mailboxd) (medium, CVSS 6.5, published 18 Jan 2017) ## Most severe Synacor vulnerabilities - [CVE-2020-7796: Synacor Zimbra Collaboration Suite SSRF in WebEx zimlet](https://junglewise.ai/threats/cve-2020-7796-synacor-zimbra-collaboration-suite-ssrf-in-webex-zimlet) (critical, exploited in the wild, CVSS 9.8, published 17 Feb 2026) - [CVE-2026-73570: Zimbra Collaboration Suite OS command injection in SMTP](https://junglewise.ai/threats/cve-2026-73570-zimbra-collaboration-suite-os-command-injection-in-smtp) (critical, exploited in the wild, CVSS 9.8, published 21 Aug 2026) - [CVE-2024-45519: Synacor Zimbra Collaboration Suite (ZCS) Command Execution Vulnerability](https://junglewise.ai/threats/cve-2024-45519-synacor-zimbra-collaboration-suite-zcs-command-execution) (critical, exploited in the wild, CVSS 9.8, published 3 Oct 2024) - [CVE-2022-41352: Synacor Zimbra Collaboration Suite (ZCS) Arbitrary File Upload Vulnerability](https://junglewise.ai/threats/cve-2022-41352-synacor-zimbra-collaboration-suite-zcs-arbitrary-file-upload) (critical, exploited in the wild, CVSS 9.8, published 20 Oct 2022) - [CVE-2022-37042: Synacor Zimbra Collaboration Suite (ZCS) Authentication Bypass Vulnerability](https://junglewise.ai/threats/cve-2022-37042-synacor-zimbra-collaboration-suite-zcs-authentication-bypass) (critical, exploited in the wild, CVSS 9.8, published 11 Aug 2022) - [CVE-2019-9670: Synacor Zimbra Collaboration Suite (ZCS) Improper Restriction of XML External Entity Reference](https://junglewise.ai/threats/cve-2019-9670-synacor-zimbra-collaboration-suite-zcs-improper-restriction-of-xml) (critical, exploited in the wild, CVSS 9.8, published 10 Jan 2022) - [CVE-2023-34192: Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) Vulnerability](https://junglewise.ai/threats/cve-2023-34192-synacor-zimbra-collaboration-suite-zcs-cross-site-scripting-xss) (critical, exploited in the wild, CVSS 9, published 25 Feb 2025) - [CVE-2025-68645: Synacor Zimbra Collaboration Suite file inclusion in RestFilter servlet](https://junglewise.ai/threats/cve-2025-68645-synacor-zimbra-collaboration-suite-file-inclusion-in-restfilter) (critical, exploited in the wild, CVSS 8.8, published 22 Dec 2025) - [CVE-2019-9621: Synacor Zimbra Collaboration Suite SSRF in ProxyServlet](https://junglewise.ai/threats/cve-2019-9621-synacor-zimbra-collaboration-suite-ssrf-in-proxyservlet) (critical, exploited in the wild, CVSS 7.5, published 7 Jul 2025) - [CVE-2022-27924: Synacor Zimbra Collaboration Suite (ZCS) Command Injection Vulnerability](https://junglewise.ai/threats/cve-2022-27924-synacor-zimbra-collaboration-suite-zcs-command-injection) (critical, exploited in the wild, CVSS 7.5, published 4 Aug 2022) ## Vulnerabilities per week 2 vulnerabilities in the last four weeks, up from none in the four before. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 1 | 1 | 1 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 0 | 0 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 0 | 0 | 0 | | 19 Oct 2026 | 0 | 0 | 0 | | 26 Oct 2026 | 2 | 0 | 0 | | 2 Nov 2026 | 0 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## Synacor technologies - [Synacor Zimbra Collaboration Suite](https://junglewise.ai/threats/technologies/zimbra-collaboration-suite): 24 vulnerabilities - [Synacor Zimbra Collaboration Suite (ZCS)](https://junglewise.ai/threats/technologies/zimbra-collaboration-suite-zcs): 19 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "Synacor vulnerabilities", https://junglewise.ai/threats/vendors/synacor, 12 November 2026.