Synacor known exploited vulnerabilities

CISA KEV catalog 2026.09.25 (1,726 CVEs) with FIRST EPSS scores from 2026-09-27.

CISA lists 19 Synacor CVEs as exploited in the wild. 6 were added in the last 12 months (latest 2026-08-21), and 6 are known to be used in ransomware campaigns.

Synacor CVEs added to CISA KEV per year

Year = when CISA added the CVE to the catalog (KEV started in November 2021).

Patch first: highest EPSS right now

EPSS is FIRST's estimate of the chance a CVE is exploited in the next 30 days.

CVE-2019-9670 (Zimbra Collaboration Suite (ZCS)): EPSS 100.0%, added 2022-01-10
CVE-2024-45519 (Zimbra Collaboration Suite (ZCS)): EPSS 99.9%, added 2024-10-03
CVE-2022-27925 (Zimbra Collaboration Suite (ZCS)): EPSS 98.7%, added 2022-08-11
CVE-2022-41352 (Zimbra Collaboration Suite (ZCS)): EPSS 95.5%, added 2022-10-20
CVE-2022-37042 (Zimbra Collaboration Suite (ZCS)): EPSS 91.9%, added 2022-08-11

Most affected Synacor products

Zimbra Collaboration Suite (ZCS) (16), Zimbra Collaboration Suite (1), Zimbra Collaboration Suite (ZCS) (1), Zimbra Collaborate Suite (ZCS) (1).

All Synacor CVEs in KEV

CVE	Product	Flaw	Added	Federal due	EPSS	Ransomware
CVE-2026-73570	Zimbra Collaboration Suite (ZCS)	Zimbra Collaboration Suite (ZCS) OS Command Injection	2026-08-21	2026-08-24	11.7%	–
CVE-2025-48700	Zimbra Collaboration Suite (ZCS)	Zimbra Collaboration Suite (ZCS) Cross-site Scripting	2026-04-20	2026-04-23	1.7%	–
CVE-2025-66376	Zimbra Collaboration Suite (ZCS)	Zimbra Collaboration Suite (ZCS) Cross-Site Scripting	2026-03-18	2026-04-01	19.6%	–
CVE-2020-7796	Zimbra Collaboration Suite	Zimbra Collaboration Suite (ZCS) Server-Side Request Forgery	2026-02-17	2026-03-10	84.4%	–
CVE-2025-68645	Zimbra Collaboration Suite (ZCS)	Zimbra Collaboration Suite (ZCS) PHP Remote File Inclusion	2026-01-22	2026-02-12	48.9%	–
CVE-2025-27915	Zimbra Collaboration Suite (ZCS)	Zimbra Collaboration Suite (ZCS) Cross-site Scripting	2025-10-07	2025-10-28	4.0%	–
CVE-2019-9621	Zimbra Collaboration Suite (ZCS)	Zimbra Collaboration Suite (ZCS) Server-Side Request Forgery (SSRF)	2025-07-07	2025-07-28	81.0%	–
CVE-2024-27443	Zimbra Collaboration Suite (ZCS)	Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS)	2025-05-19	2025-06-09	23.6%	–
CVE-2023-34192	Zimbra Collaboration Suite (ZCS)	Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS)	2025-02-25	2025-03-18	77.3%	–
CVE-2024-45519	Zimbra Collaboration Suite (ZCS)	Zimbra Collaboration Suite (ZCS) Command Execution	2024-10-03	2024-10-24	99.9%	–
CVE-2023-37580	Zimbra Collaboration Suite (ZCS)	Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS)	2023-07-27	2023-08-17	49.1%	–
CVE-2022-27926	Zimbra Collaboration Suite (ZCS)	Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS)	2023-04-03	2023-04-24	17.6%	–
CVE-2022-41352	Zimbra Collaboration Suite (ZCS)	Zimbra Collaboration Suite (ZCS) Arbitrary File Upload	2022-10-20	2022-11-10	95.5%	Yes
CVE-2022-37042	Zimbra Collaboration Suite (ZCS)	Zimbra Collaboration Suite (ZCS) Authentication Bypass	2022-08-11	2022-09-01	91.9%	Yes
CVE-2022-27925	Zimbra Collaboration Suite (ZCS)	Zimbra Collaboration Suite (ZCS) Arbitrary File Upload	2022-08-11	2022-09-01	98.7%	Yes
CVE-2022-27924	Zimbra Collaboration Suite (ZCS)	Zimbra Collaboration Suite (ZCS) Command Injection	2022-08-04	2022-08-25	85.4%	Yes
CVE-2018-6882	Zimbra Collaboration Suite (ZCS)	Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS)	2022-04-19	2022-05-10	29.8%	Yes
CVE-2022-24682	Zimbra Collaborate Suite (ZCS)	Zimbra Collaborate Suite (ZCS) Cross-Site Scripting	2022-02-25	2022-03-11	30.9%	Yes
CVE-2019-9670	Zimbra Collaboration Suite (ZCS)	Zimbra Collaboration Suite (ZCS) Improper Restriction of XML External Entity Reference	2022-01-10	2022-07-10	100.0%	–

Federal due dates bind US federal civilian agencies (CISA binding operational directives); everyone else can use them as a priority hint. Sources: CISA KEV, FIRST EPSS.