Vendor

Synacor

19 of 19 Synacor CVEs in Patchfirst (100%) are in of vulnerabilities exploited in the wild, 6 of them used by ransomware.

CVEs: 19
In CISA KEV: 19100%
Known ransomware use: 6
Median days to KEV: 209; from publication
Latest KEV listing: 21 Aug 2026

Watch Synacor Subscribe (RSS) JSON Feed All feeds

Products

In KEVOther CVEs

ProductKEVCVEs
Zimbra Collaboration Suite (ZCS) In KEV: 17 CVEs: 17
Zimbra Collaborate Suite (ZCS) In KEV: 1 CVEs: 1
Zimbra Collaboration Suite In KEV: 1 CVEs: 1

Top ATT&CK techniques

What attackers do with Synacor CVEs

TechniqueCVEs
T1190Exploit Public-Facing Application CVEs: 9
T1059Command and Scripting Interpreter CVEs: 6
T1059.007JavaScript CVEs: 5
T1005Data from Local System CVEs: 3
T1566.002Spearphishing Link CVEs: 3

Open in ATT&CK Navigator

A layer for MITRE’s ATT&CK Navigator: techniques scored by the highest Patchfirst priority among their CVEs, neutral to red, with the CVE ids in each comment. “Open in Navigator” loads https://patchfirst.co/navigator/vendor/synacor.json. Or download it and in Navigator choose Open Existing Layer → Upload from local.

Counts are Synacor CVEs linked to the technique. Each link’s provenance is on the CVE page.

Synacor CVEs

19 CVEs, by priority

CVE-2022-41352Synacor Zimbra Collaboration Suite (ZCS) Arbitrary File Upload Vulnerability
Synacor · Zimbra Collaboration Suite (ZCS)KEVRansomwarePublic exploitCritical · 9.8T1190Exploit Public-Facing Application T1505.003Web Shell
95.5%Top 0.13%
79.8priority
CVE-2022-37042Synacor Zimbra Collaboration Suite (ZCS) Authentication Bypass Vulnerability
Synacor · Zimbra Collaboration Suite (ZCS)KEVRansomwarePublic exploitCritical · 9.8T1190Exploit Public-Facing Application T1059Command and Scripting Interpreter
92.1%Top 0.18%
79.8priority
CVE-2026-73570Zimbra Collaboration Suite (ZCS) OS Command Injection Vulnerability
Synacor · Zimbra Collaboration Suite (ZCS)KEVPublic exploitHigh · 8.9T1190Exploit Public-Facing Application T1059Command and Scripting Interpreter
71.7%Top 0.58%
79.1priority
CVE-2022-27924Synacor Zimbra Collaboration Suite (ZCS) Command Injection Vulnerability
Synacor · Zimbra Collaboration Suite (ZCS)KEVRansomwarePublic exploitHigh · 7.5T1190Exploit Public-Facing Application T1565.001Stored Data Manipulation
93.9%Top 0.16%
78.2priority
CVE-2022-27925Synacor Zimbra Collaboration Suite (ZCS) Arbitrary File Upload Vulnerability
Synacor · Zimbra Collaboration Suite (ZCS)KEVRansomwarePublic exploitHigh · 7.2T1190Exploit Public-Facing Application T1005Data from Local System
98.7%Top 0.08%
78.0priority
CVE-2022-24682Synacor Zimbra Collaborate Suite (ZCS) Cross-Site Scripting Vulnerability
Synacor · Zimbra Collaborate Suite (ZCS)KEVRansomwarePublic exploitMedium · 6.1T1204.001Malicious Link T1059.007JavaScript+1 more
30.9%Top 1.7%
76.9priority
CVE-2018-6882Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) Vulnerability
Synacor · Zimbra Collaboration Suite (ZCS)KEVRansomwarePublic exploitMedium · 6.1T1566.002Spearphishing Link T1059Command and Scripting Interpreter
29.8%Top 1.8%
76.9priority
CVE-2019-9670Synacor Zimbra Collaboration Suite (ZCS) Improper Restriction of XML External Entity Reference
Synacor · Zimbra Collaboration Suite (ZCS)KEVPublic exploitCritical · 9.8T1190Exploit Public-Facing Application T1005Data from Local System2 reports
>99.9%Top 0.02%
76.0priority
CVE-2025-68645Synacor Zimbra Collaboration Suite (ZCS) PHP Remote File Inclusion Vulnerability
Synacor · Zimbra Collaboration Suite (ZCS)KEVPublic exploitHigh · 8.8T1005Data from Local System
48.9%Top 1.1%
73.9priority
CVE-2022-27926Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) Vulnerability
Synacor · Zimbra Collaboration Suite (ZCS)KEVPublic exploitMedium · 6.1T1189Drive-by Compromise T1059.007JavaScript1 report
17.6%Top 2.9%
70.6priority
CVE-2024-45519Synacor Zimbra Collaboration Suite (ZCS) Command Execution Vulnerability
Synacor · Zimbra Collaboration Suite (ZCS)KEVPublic exploitCritical · 9.8T1190Exploit Public-Facing Application T1059Command and Scripting Interpreter
99.9%Top 0.03%
69.9priority
CVE-2020-7796Synacor Zimbra Collaboration Suite (ZCS) Server-Side Request Forgery Vulnerability
Synacor · Zimbra Collaboration SuiteKEVPublic exploitCritical · 9.8T1190Exploit Public-Facing Application T1090Proxy
93.6%Top 0.16%
69.8priority
CVE-2023-34192Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) Vulnerability
Synacor · Zimbra Collaboration Suite (ZCS)KEVPublic exploitCritical · 9.0T1059Command and Scripting Interpreter T1055Process Injection+1 more
77.3%Top 0.44%
69.2priority
CVE-2019-9621Synacor Zimbra Collaboration Suite (ZCS) Server-Side Request Forgery (SSRF) Vulnerability
Synacor · Zimbra Collaboration Suite (ZCS)KEVPublic exploitHigh · 7.5T1190Exploit Public-Facing Application T1090Proxy
81.0%Top 0.37%
68.2priority
CVE-2023-37580Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) Vulnerability
Synacor · Zimbra Collaboration Suite (ZCS)KEVPublic exploitMedium · 6.1T1204.001Malicious Link T1059.007JavaScript
49.1%Top 1.1%
67.0priority
CVE-2025-66376Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting Vulnerability
Synacor · Zimbra Collaboration Suite (ZCS)KEVMedium · 6.1T1566.001Spearphishing Attachment T1059.007JavaScript
20.2%Top 2.5%
66.8priority
CVE-2024-27443Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) Vulnerability
Synacor · Zimbra Collaboration Suite (ZCS)KEVPublic exploitMedium · 6.1T1566.002Spearphishing Link T1059.004Unix Shell+2 more
24.6%Top 2.1%
66.8priority
CVE-2025-27915Synacor Zimbra Collaboration Suite (ZCS) Cross-site Scripting Vulnerability
Synacor · Zimbra Collaboration Suite (ZCS)KEVPublic exploitMedium · 5.4T1566Phishing T1059Command and Scripting Interpreter
4.1%Top 9.3%
64.9priority
CVE-2025-48700Synacor Zimbra Collaboration Suite (ZCS) Cross-site Scripting Vulnerability
Synacor · Zimbra Collaboration Suite (ZCS)KEVMedium · 6.1T1566.002Spearphishing Link T1059.007JavaScript+1 more
1.7%Top 23%
62.7priority