Live monitoring Updated 72-hour alert levelMajor alert Editor: Frédéric LENQUETTE
CYBERIACKCybersecurity & AI intelligence · by Frédéric LENQUETTE

Vendor

Synacor: actively exploited vulnerabilities

19 vulnerabilities in Synacor products are listed in CISA’s catalog of actively exploited vulnerabilities, 6 of them used by ransomware. Latest addition on August 21, 2026: CVE-2026-73570 (Zimbra Collaboration Suite (ZCS)).

Affected products

  • Zimbra Collaboration Suite (ZCS)17
  • Zimbra Collaborate Suite (ZCS)1
  • Zimbra Collaboration Suite1

All exploited vulnerabilities

CISA KEV catalog, newest first: each entry corresponds to observed exploitation.

2026 5 vulnerabilities

  1. CVE-2026-73570

    Zimbra Collaboration Suite (ZCS) OS Command Injection Vulnerability

    NVD entryCISA catalog

  2. CVE-2025-48700

    Synacor Zimbra Collaboration Suite (ZCS) Cross-site Scripting Vulnerability

    NVD entryCISA catalog

  3. CVE-2025-66376

    Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting Vulnerability

    NVD entryCISA catalog

  4. CVE-2020-7796

    Synacor Zimbra Collaboration Suite (ZCS) Server-Side Request Forgery Vulnerability

    NVD entryCISA catalog

  5. CVE-2025-68645

    Synacor Zimbra Collaboration Suite (ZCS) PHP Remote File Inclusion Vulnerability

    NVD entryCISA catalog

2025 4 vulnerabilities

  1. CVE-2025-27915

    Synacor Zimbra Collaboration Suite (ZCS) Cross-site Scripting Vulnerability

    NVD entryCISA catalog

  2. CVE-2019-9621

    Synacor Zimbra Collaboration Suite (ZCS) Server-Side Request Forgery (SSRF) Vulnerability

    NVD entryCISA catalog

  3. CVE-2024-27443

    Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) Vulnerability

    NVD entryCISA catalog

  4. CVE-2023-34192

    Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) Vulnerability

    NVD entryCISA catalog

2024 1 vulnerability

  1. CVE-2024-45519

    Synacor Zimbra Collaboration Suite (ZCS) Command Execution Vulnerability

    NVD entryCISA catalog

2023 2 vulnerabilities

  1. CVE-2023-37580

    Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) Vulnerability

    NVD entryCISA catalog

  2. CVE-2022-27926

    Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) Vulnerability

    NVD entryCISA catalog

2022 7 vulnerabilities

  1. CVE-2022-41352Used by ransomware

    Synacor Zimbra Collaboration Suite (ZCS) Arbitrary File Upload Vulnerability

    NVD entryCISA catalog

  2. CVE-2022-37042Used by ransomware

    Synacor Zimbra Collaboration Suite (ZCS) Authentication Bypass Vulnerability

    NVD entryCISA catalog

  3. CVE-2022-27925Used by ransomware

    Synacor Zimbra Collaboration Suite (ZCS) Arbitrary File Upload Vulnerability

    NVD entryCISA catalog

  4. CVE-2022-27924Used by ransomware

    Synacor Zimbra Collaboration Suite (ZCS) Command Injection Vulnerability

    NVD entryCISA catalog

  5. CVE-2018-6882Used by ransomware

    Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) Vulnerability

    NVD entryCISA catalog

  6. CVE-2022-24682Used by ransomware

    Synacor Zimbra Collaborate Suite (ZCS) Cross-Site Scripting Vulnerability

    NVD entryCISA catalog

  7. CVE-2019-9670

    Synacor Zimbra Collaboration Suite (ZCS) Improper Restriction of XML External Entity Reference

    NVD entryCISA catalog

What to do

If your estate includes any of these products, make sure the vendor’s patches are applied, starting with the most recent vulnerabilities and those used by ransomware, then look for signs of compromise: an exploited vulnerability has often been used before it was fixed.

Additions from all vendors are tracked on the Actively exploited vulnerabilities page, updated several times a day. Sources: CISA KEV catalog (US public domain) and CERT-FR.