Email, files and business apps

Zimbra (Synacor) security incident history

Updated Oct 26, 2026. Data gathered daily from official public sources.

As of Oct 26, 2026, Vendor History found 19 actively exploited security flaws for Zimbra (Synacor), dated Jan 10, 2022 to Aug 21, 2026. Sources checked: the California and Washington Attorney General breach lists and CISA's Known Exploited Vulnerabilities catalog.

Breach notices and SEC cyber filings

None found in the sources we check.

Got a breach letter from Zimbra (Synacor)? What to do when a vendor has a data breach.

Actively exploited security flaws

Flaws in Zimbra (Synacor) products that CISA lists as exploited by attackers. If you use an affected product, check that it's updated. What a listing means.

1. Aug 21, 2026Exploited flaw

   Zimbra Collaboration Suite (ZCS) OS Command Injection Vulnerability (CVE-2026-73570). Added to CISA's list of security flaws known to be exploited by attackers.

   Source: CISA Known Exploited Vulnerabilities catalog

2. Apr 20, 2026Exploited flaw

   Synacor Zimbra Collaboration Suite (ZCS) Cross-site Scripting Vulnerability (CVE-2025-48700). Added to CISA's list of security flaws known to be exploited by attackers.

   Source: CISA Known Exploited Vulnerabilities catalog

3. Mar 18, 2026Exploited flaw

   Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting Vulnerability (CVE-2025-66376). Added to CISA's list of security flaws known to be exploited by attackers.

   Source: CISA Known Exploited Vulnerabilities catalog

4. Feb 17, 2026Exploited flaw

   Synacor Zimbra Collaboration Suite (ZCS) Server-Side Request Forgery Vulnerability (CVE-2020-7796). Added to CISA's list of security flaws known to be exploited by attackers.

   Source: CISA Known Exploited Vulnerabilities catalog

5. Jan 22, 2026Exploited flaw

   Synacor Zimbra Collaboration Suite (ZCS) PHP Remote File Inclusion Vulnerability (CVE-2025-68645). Added to CISA's list of security flaws known to be exploited by attackers.

   Source: CISA Known Exploited Vulnerabilities catalog

6. Oct 7, 2025Exploited flaw

   Synacor Zimbra Collaboration Suite (ZCS) Cross-site Scripting Vulnerability (CVE-2025-27915). Added to CISA's list of security flaws known to be exploited by attackers.

   Source: CISA Known Exploited Vulnerabilities catalog

7. Jul 7, 2025Exploited flaw

   Synacor Zimbra Collaboration Suite (ZCS) Server-Side Request Forgery (SSRF) Vulnerability (CVE-2019-9621). Added to CISA's list of security flaws known to be exploited by attackers.

   Source: CISA Known Exploited Vulnerabilities catalog

8. May 19, 2025Exploited flaw

   Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) Vulnerability (CVE-2024-27443). Added to CISA's list of security flaws known to be exploited by attackers.

   Source: CISA Known Exploited Vulnerabilities catalog

9. Feb 25, 2025Exploited flaw

   Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) Vulnerability (CVE-2023-34192). Added to CISA's list of security flaws known to be exploited by attackers.

   Source: CISA Known Exploited Vulnerabilities catalog

10. Oct 3, 2024Exploited flaw

    Synacor Zimbra Collaboration Suite (ZCS) Command Execution Vulnerability (CVE-2024-45519). Added to CISA's list of security flaws known to be exploited by attackers.

    Source: CISA Known Exploited Vulnerabilities catalog

11. Jul 27, 2023Exploited flaw

    Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) Vulnerability (CVE-2023-37580). Added to CISA's list of security flaws known to be exploited by attackers.

    Source: CISA Known Exploited Vulnerabilities catalog

12. Apr 3, 2023Exploited flaw

    Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) Vulnerability (CVE-2022-27926). Added to CISA's list of security flaws known to be exploited by attackers.

    Source: CISA Known Exploited Vulnerabilities catalog

13. Oct 20, 2022Exploited flaw

    Synacor Zimbra Collaboration Suite (ZCS) Arbitrary File Upload Vulnerability (CVE-2022-41352). Added to CISA's list of security flaws known to be exploited by attackers. CISA lists it as used in ransomware campaigns.

    Source: CISA Known Exploited Vulnerabilities catalog

14. Aug 11, 2022Exploited flaw

    Synacor Zimbra Collaboration Suite (ZCS) Arbitrary File Upload Vulnerability (CVE-2022-27925). Added to CISA's list of security flaws known to be exploited by attackers. CISA lists it as used in ransomware campaigns.

    Source: CISA Known Exploited Vulnerabilities catalog

15. Aug 11, 2022Exploited flaw

    Synacor Zimbra Collaboration Suite (ZCS) Authentication Bypass Vulnerability (CVE-2022-37042). Added to CISA's list of security flaws known to be exploited by attackers. CISA lists it as used in ransomware campaigns.

    Source: CISA Known Exploited Vulnerabilities catalog

16. Aug 4, 2022Exploited flaw

    Synacor Zimbra Collaboration Suite (ZCS) Command Injection Vulnerability (CVE-2022-27924). Added to CISA's list of security flaws known to be exploited by attackers. CISA lists it as used in ransomware campaigns.

    Source: CISA Known Exploited Vulnerabilities catalog

17. Apr 19, 2022Exploited flaw

    Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) Vulnerability (CVE-2018-6882). Added to CISA's list of security flaws known to be exploited by attackers. CISA lists it as used in ransomware campaigns.

    Source: CISA Known Exploited Vulnerabilities catalog

18. Feb 25, 2022Exploited flaw

    Synacor Zimbra Collaborate Suite (ZCS) Cross-Site Scripting Vulnerability (CVE-2022-24682). Added to CISA's list of security flaws known to be exploited by attackers. CISA lists it as used in ransomware campaigns.

    Source: CISA Known Exploited Vulnerabilities catalog

19. Jan 10, 2022Exploited flaw

    Synacor Zimbra Collaboration Suite (ZCS) Improper Restriction of XML External Entity Reference (CVE-2019-9670). Added to CISA's list of security flaws known to be exploited by attackers.

    Source: CISA Known Exploited Vulnerabilities catalog

We check: California and Washington Attorney General breach notices, SEC cyber incident filings (Form 8-K, Item 1.05) and CISA's catalog of actively exploited security flaws. An empty section means we found nothing in those sources. It does not mean nothing happened. How it works

To cite: Vendor History, "Zimbra (Synacor) security incident history," vendorhistory.com/vendor/zimbra, data checked Oct 26, 2026. Free to reuse under CC BY 4.0 with credit to Vendor History.