Product of Synacor

Zimbra Collaboration Suite (ZCS)

As of , 17 Synacor Zimbra Collaboration Suite (ZCS) vulnerabilities are on CISA's list of exploited vulnerabilities, 5 of them used in ransomware campaigns; 4 were added in 2026. Patch first: CVE-2026-73570.

Patch first

Patch first
#VulnerabilityProductOur groupListedDeadlineEPSS
1CVE-2026-73570OS Command InjectionSynacor Zimbra Collaboration Suite (ZCS)Patch nowForensic triage required by CISA0.72
2CVE-2019-9621Server-Side Request Forgery (SSRF)Synacor Zimbra Collaboration Suite (ZCS)Patch this weekMetasploit module; EPSS 0.81; verified Exploit-DB entry0.81
3CVE-2019-9670Improper Restriction of XML External Entity ReferenceSynacor Zimbra Collaboration Suite (ZCS)Patch this weekMetasploit module; EPSS 0.99; verified Exploit-DB entry0.99
4CVE-2022-41352Arbitrary File UploadSynacor Zimbra Collaboration Suite (ZCS)Patch this weekRansomware use; Metasploit module; EPSS 0.950.95
5CVE-2022-27925Arbitrary File UploadSynacor Zimbra Collaboration Suite (ZCS)Patch this weekRansomware use; Metasploit module; EPSS 0.990.99
6CVE-2022-37042Authentication BypassSynacor Zimbra Collaboration Suite (ZCS)Patch this weekRansomware use; Metasploit module; EPSS 0.920.92
7CVE-2023-34192Cross-Site Scripting (XSS)Synacor Zimbra Collaboration Suite (ZCS)Patch this weekEPSS 0.770.77
8CVE-2024-45519Command ExecutionSynacor Zimbra Collaboration Suite (ZCS)Patch this weekEPSS 0.990.99
9CVE-2022-27924Command InjectionSynacor Zimbra Collaboration Suite (ZCS)Patch this weekRansomware use; EPSS 0.940.94
10CVE-2018-6882Cross-Site Scripting (XSS)Synacor Zimbra Collaboration Suite (ZCS)Patch this weekRansomware use0.30
11CVE-2025-68645PHP Remote File InclusionSynacor Zimbra Collaboration Suite (ZCS)Patch soon0.49
12CVE-2023-37580Cross-Site Scripting (XSS)Synacor Zimbra Collaboration Suite (ZCS)Patch soon0.49
13CVE-2025-66376Cross-Site ScriptingSynacor Zimbra Collaboration Suite (ZCS)Patch soon0.20
14CVE-2024-27443Cross-Site Scripting (XSS)Synacor Zimbra Collaboration Suite (ZCS)Patch soon0.24
15CVE-2022-27926Cross-Site Scripting (XSS)Synacor Zimbra Collaboration Suite (ZCS)Patch soon0.18
16CVE-2025-27915Cross-site ScriptingSynacor Zimbra Collaboration Suite (ZCS)Patch soon0.04
17CVE-2025-48700Cross-site ScriptingSynacor Zimbra Collaboration Suite (ZCS)Patch soon0.02

Added each year

2462022: 6620222023: 2220232024: 1120242025: 4420252026: 442026
Entries CISA added each year, removed ones included. Source: CISA KEV.
Show the numbers
Periodentries added
20226
20232
20241
20254
20264

Used in ransomware

Changes CISA made to these entries

  1. CVE-2022-41352 Synacor Zimbra Collaboration Suite (ZCS)Ransomware use: Unknown to Known.
  2. CVE-2022-27924 Synacor Zimbra Collaboration Suite (ZCS)Ransomware use: Unknown to Known.
  3. CVE-2022-37042 Synacor Zimbra Collaboration Suite (ZCS)Ransomware use: Unknown to Known.
  4. CVE-2022-27925 Synacor Zimbra Collaboration Suite (ZCS)Ransomware use: Unknown to Known.
  5. CVE-2024-45519 Synacor Zimbra Collaboration Suite (ZCS)Renamed from Zimbra Collaboration to Zimbra Collaboration Suite (ZCS). Edited: description and name.
  6. CVE-2023-37580 Synacor Zimbra Collaboration Suite (ZCS)Renamed from Zimbra Collaboration (ZCS) to Synacor Zimbra Collaboration Suite (ZCS). Edited: description and name.
  7. CVE-2022-41352 Synacor Zimbra Collaboration Suite (ZCS)Renamed from Zimbra Collaboration (ZCS) to Synacor Zimbra Collaboration Suite (ZCS). Edited: description and name.
  8. CVE-2022-37042 Synacor Zimbra Collaboration Suite (ZCS)Renamed from Zimbra Collaboration (ZCS) to Synacor Zimbra Collaboration Suite (ZCS). Edited: description and name.
  9. CVE-2022-27926 Synacor Zimbra Collaboration Suite (ZCS)Renamed from Zimbra Collaboration (ZCS) to Synacor Zimbra Collaboration Suite (ZCS). Edited: description and name.
  10. CVE-2022-27925 Synacor Zimbra Collaboration Suite (ZCS)Renamed from Zimbra Collaboration (ZCS) to Synacor Zimbra Collaboration Suite (ZCS). Edited: description and name.

Every change we recorded