Vendor dossier / #15
Synacor vulnerabilities in CISA KEV
Answer CISA's KEV catalog lists 19 Synacor vulnerabilities as of catalog 2026.09.23, 1.1% of all 1,721 entries and rank 15 of 283 vendors. The first was added on 2022-01-10 and the most recent on 2026-08-21; 6 are flagged as used in ransomware campaigns.
- KEV entries
- 191.1% of catalog
- Last 90 days
- +1added
- Ransomware: known
- 631.6%
- Products
- 4distinct
- First added
- 2022-01-10
- Latest added
- 2026-08-21
- Median days to due
- 21
- Open deadlines
- 0federal
TAdditions per quarter
Table view (by year)
| Year | Added |
|---|---|
| 2021 | 0 |
| 2022 | 7 |
| 2023 | 2 |
| 2024 | 1 |
| 2025 | 4 |
| 2026 | 5 |
QCommon questions
How many Synacor vulnerabilities are in CISA KEV?
19, as of KEV catalog 2026.09.23 (released 2026-09-23). That is 1.1% of the catalog.
Which Synacor product has the most KEV entries?
Zimbra Collaboration Suite (ZCS), with 16 entries. 4 products appear in total.
How many Synacor KEV vulnerabilities are linked to ransomware?
6 of 19 (31.6%) are flagged by CISA as known to be used in ransomware campaigns.
When was the latest Synacor vulnerability added to KEV?
2026-08-21 (CVE-2026-73570).
What is the most common weakness in Synacor KEV entries?
CWE-79 (Cross-site scripting (XSS)), listed on 9 entries.
PProducts
| Product | Entries | Share of vendor |
|---|---|---|
| Zimbra Collaboration Suite (ZCS) | 16 | 84.2% |
| Zimbra Collaboration Suite | 1 | 5.3% |
| Zimbra Collaboration Suite (ZCS) | 1 | 5.3% |
| Zimbra Collaborate Suite (ZCS) | 1 | 5.3% |
WWeaknesses
| CWE | Entries | Share of vendor |
|---|---|---|
| CWE-79 Cross-site scripting (XSS) | 9 | 47.4% |
| CWE-918 Server-side request forgery | 2 | 10.5% |
| CWE-22 Path traversal | 2 | 10.5% |
| CWE-78 OS command injection | 1 | 5.3% |
| CWE-98 | 1 | 5.3% |
| CWE-807 | 1 | 5.3% |
| CWE-284 Improper access control | 1 | 5.3% |
| CWE-138 | 1 | 5.3% |
| CWE-23 Relative path traversal | 1 | 5.3% |
| CWE-93 | 1 | 5.3% |
| CWE-116 | 1 | 5.3% |
| CWE-611 XML external entity (XXE) | 1 | 5.3% |
EAll 19 entries
| CVE | Product | Vulnerability | Added | Due | Ransomware | CWE |
|---|---|---|---|---|---|---|
| CVE-2026-73570 | Zimbra Collaboration Suite (ZCS) | Zimbra Collaboration Suite (ZCS) OS Command Injection Vulnerability | Unknown | CWE-78 | ||
| CVE-2025-48700 | Zimbra Collaboration Suite (ZCS) | Synacor Zimbra Collaboration Suite (ZCS) Cross-site Scripting Vulnerability | Unknown | CWE-79 | ||
| CVE-2025-66376 | Zimbra Collaboration Suite (ZCS) | Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting Vulnerability | Unknown | CWE-79 | ||
| CVE-2020-7796 | Zimbra Collaboration Suite | Synacor Zimbra Collaboration Suite (ZCS) Server-Side Request Forgery Vulnerability | Unknown | CWE-918 | ||
| CVE-2025-68645 | Zimbra Collaboration Suite (ZCS) | Synacor Zimbra Collaboration Suite (ZCS) PHP Remote File Inclusion Vulnerability | Unknown | CWE-98 | ||
| CVE-2025-27915 | Zimbra Collaboration Suite (ZCS) | Synacor Zimbra Collaboration Suite (ZCS) Cross-site Scripting Vulnerability | Unknown | CWE-79 | ||
| CVE-2019-9621 | Zimbra Collaboration Suite (ZCS) | Synacor Zimbra Collaboration Suite (ZCS) Server-Side Request Forgery (SSRF) Vulnerability | Unknown | CWE-918, CWE-807 | ||
| CVE-2024-27443 | Zimbra Collaboration Suite (ZCS) | Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) Vulnerability | Unknown | CWE-79 | ||
| CVE-2023-34192 | Zimbra Collaboration Suite (ZCS) | Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) Vulnerability | Unknown | CWE-79 | ||
| CVE-2024-45519 | Zimbra Collaboration Suite (ZCS) | Synacor Zimbra Collaboration Suite (ZCS) Command Execution Vulnerability | Unknown | CWE-284 | ||
| CVE-2023-37580 | Zimbra Collaboration Suite (ZCS) | Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) Vulnerability | Unknown | CWE-79 | ||
| CVE-2022-27926 | Zimbra Collaboration Suite (ZCS) | Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) Vulnerability | Unknown | CWE-79, CWE-138 | ||
| CVE-2022-41352 | Zimbra Collaboration Suite (ZCS) | Synacor Zimbra Collaboration Suite (ZCS) Arbitrary File Upload Vulnerability | Known | CWE-22 | ||
| CVE-2022-37042 | Zimbra Collaboration Suite (ZCS) | Synacor Zimbra Collaboration Suite (ZCS) Authentication Bypass Vulnerability | Known | CWE-23 | ||
| CVE-2022-27925 | Zimbra Collaboration Suite (ZCS) | Synacor Zimbra Collaboration Suite (ZCS) Arbitrary File Upload Vulnerability | Known | CWE-22 | ||
| CVE-2022-27924 | Zimbra Collaboration Suite (ZCS) | Synacor Zimbra Collaboration Suite (ZCS) Command Injection Vulnerability | Known | CWE-93 | ||
| CVE-2018-6882 | Zimbra Collaboration Suite (ZCS) | Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) Vulnerability | Known | CWE-79 | ||
| CVE-2022-24682 | Zimbra Collaborate Suite (ZCS) | Synacor Zimbra Collaborate Suite (ZCS) Cross-Site Scripting Vulnerability | Known | CWE-79, CWE-116 | ||
| CVE-2019-9670 | Zimbra Collaboration Suite (ZCS) | Synacor Zimbra Collaboration Suite (ZCS) Improper Restriction of XML External Entity Reference | Unknown | CWE-611 |
Cite this
CISA's Known Exploited Vulnerabilities catalog lists 19 Synacor vulnerabilities (1.1% of all entries). Source: Telemetry analysis of the CISA Known Exploited Vulnerabilities catalog, version 2026.09.23 (released 2026-09-23). https://glide-telemetry.pages.dev/vendors/synacor/
Source: CISA KEV catalog v2026.09.23, released 2026-09-23. Windows end 2026-09-23. Vendor names are CISA's vendorProject strings; Telemetry states no facts about Synacor beyond this data.