Synacor Zimbra Collaboration Suite (ZCS) known exploited vulnerabilities, ranked
CISA lists 16 Synacor Zimbra Collaboration Suite (ZCS) CVEs as exploited in the wild. 4 were added in the last 12 months and 5 are known to be used in ransomware. The table ranks all of them by EPSS, FIRST's estimate of the chance a CVE is exploited in the next 30 days, so the first rows are the ones to patch first.
Patch these first
- CVE-2019-9670: EPSS 99.99%, added 2022-01-10
- CVE-2024-45519: EPSS 99.91%, added 2024-10-03
- CVE-2022-27925: EPSS 98.7%, used in ransomware, added 2022-08-11
- CVE-2022-41352: EPSS 95.5%, used in ransomware, added 2022-10-20
- CVE-2022-27924: EPSS 93.9%, used in ransomware, added 2022-08-04
All 16 Synacor Zimbra Collaboration Suite (ZCS) CVEs in CISA KEV, by EPSS
| # | CVE | Flaw | EPSS | Ransomware | Added | Federal due |
|---|---|---|---|---|---|---|
| 1 | CVE-2019-9670 | Zimbra Collaboration Suite (ZCS) Improper Restriction of XML External Entity Reference | 99.99% | – | 2022-01-10 | 2022-07-10 |
| 2 | CVE-2024-45519 | Zimbra Collaboration Suite (ZCS) Command Execution | 99.91% | – | 2024-10-03 | 2024-10-24 |
| 3 | CVE-2022-27925 | Zimbra Collaboration Suite (ZCS) Arbitrary File Upload | 98.7% | Yes | 2022-08-11 | 2022-09-01 |
| 4 | CVE-2022-41352 | Zimbra Collaboration Suite (ZCS) Arbitrary File Upload | 95.5% | Yes | 2022-10-20 | 2022-11-10 |
| 5 | CVE-2022-27924 | Zimbra Collaboration Suite (ZCS) Command Injection | 93.9% | Yes | 2022-08-04 | 2022-08-25 |
| 6 | CVE-2022-37042 | Zimbra Collaboration Suite (ZCS) Authentication Bypass | 91.9% | Yes | 2022-08-11 | 2022-09-01 |
| 7 | CVE-2019-9621 | Zimbra Collaboration Suite (ZCS) Server-Side Request Forgery (SSRF) | 81.0% | – | 2025-07-07 | 2025-07-28 |
| 8 | CVE-2023-34192 | Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) | 77.3% | – | 2025-02-25 | 2025-03-18 |
| 9 | CVE-2023-37580 | Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) | 49.1% | – | 2023-07-27 | 2023-08-17 |
| 10 | CVE-2018-6882 | Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) | 29.8% | Yes | 2022-04-19 | 2022-05-10 |
| 11 | CVE-2024-27443 | Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) | 23.6% | – | 2025-05-19 | 2025-06-09 |
| 12 | CVE-2025-66376 | Zimbra Collaboration Suite (ZCS) Cross-Site Scripting | 20.2% | – | 2026-03-18 | 2026-04-01 |
| 13 | CVE-2022-27926 | Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) | 17.6% | – | 2023-04-03 | 2023-04-24 |
| 14 | CVE-2026-73570 | Zimbra Collaboration Suite (ZCS) OS Command Injection | 11.7% | – | 2026-08-21 | 2026-08-24 |
| 15 | CVE-2025-27915 | Zimbra Collaboration Suite (ZCS) Cross-site Scripting | 4.0% | – | 2025-10-07 | 2025-10-28 |
| 16 | CVE-2025-48700 | Zimbra Collaboration Suite (ZCS) Cross-site Scripting | 1.7% | – | 2026-04-20 | 2026-04-23 |
EPSS changes daily; a CVE with a low EPSS that is in KEV is still exploited somewhere. Federal due dates bind US federal civilian agencies; everyone else can use them as a priority hint.
Sources: CISA KEV, FIRST EPSS.
More: all Synacor KEV CVEs · free KEV badge for Synacor · all vendors