Vulnerabilities by vendor · updated on every deploy
Zimbra vulnerabilities: exploited CVEs and our analysis
Zimbra has 19 vulnerabilities in CISA's Known Exploited Vulnerabilities catalog, 5 of them added in the last 12 months and 6 known to be used in ransomware campaigns. Below: the analysis Zero Hunt Research published on Zimbra products, then the catalog entries newest first with the federal due date.
CISA catalog version 2026.10.21, released 2026-10-21 14:04 UTC.
19
CVEs in CISA KEV
5
Added in the last 12 months
6
Known ransomware use
1
Zero Hunt analyses
Products with the most KEV entries: Zimbra Collaboration Suite (ZCS) (16) · Zimbra Collaboration Suite (ZCS) (1) · Zimbra Collaborate Suite (ZCS) (1) · Zimbra Collaboration Suite (1)
Our analysis of Zimbra vulnerabilities
2026-07-12
Zimbra Webmail XSS: The Crafted Email That Empties the MailboxGoogle TAG flagged a stored XSS in Zimbra's Classic Web Client, fixed in ZCS 10.1.19. No CVE, no CVSS — and the crafted email is not the part you'll catch. Here's the runbook.
All 19 KEV entries
| Added | CVE | Product and vulnerability | Federal due date | Flags | Our analysis |
|---|---|---|---|---|---|
| 2026-08-21 | CVE-2026-73570 | Zimbra Collaboration Suite (ZCS) Zimbra Collaboration Suite (ZCS) contains an OS command injection vulnerability which could allow an unauthenticated attacker to send specially crafted SMTP requests that may result in execution of arbitrary operating… | 2026-08-24 | Forensic triage | — |
| 2026-04-20 | CVE-2025-48700 | Zimbra Collaboration Suite (ZCS) Synacor Zimbra Collaboration Suite (ZCS) contains a cross-site scripting vulnerability that could allow attackers to execute arbitrary JavaScript within the user's session, potentially leading to unauthorized access t… | 2026-04-23 | — | |
| 2026-03-18 | CVE-2025-66376 | Zimbra Collaboration Suite (ZCS) Synacor Zimbra Collaboration Suite (ZCS) contains a cross-site scripting vulnerability in the Classic UI where attackers could abuse Cascading Style Sheets (CSS) @import directives in email HTML. | 2026-04-01 | — | |
| 2026-02-17 | CVE-2020-7796 | Zimbra Collaboration Suite Synacor Zimbra Collaboration Suite (ZCS) contains a server-side request forgery vulnerability if WebEx zimlet installed and zimlet JSP is enabled. | 2026-03-10 | — | |
| 2026-01-22 | CVE-2025-68645 | Zimbra Collaboration Suite (ZCS) Synacor Zimbra Collaboration Suite (ZCS) contains a PHP remote file inclusion vulnerability that could allow for remote attackers to craft requests to the /h/rest endpoint to influence internal request dispatching, al… | 2026-02-12 | — | |
| 2025-10-07 | CVE-2025-27915 | Zimbra Collaboration Suite (ZCS) Synacor Zimbra Collaboration Suite (ZCS) contains a cross-site scripting vulnerability that exists in the Classic Web Client due to insufficient sanitization of HTML content in ICS files. When a user views an e-mail m… | 2025-10-28 | — | |
| 2025-07-07 | CVE-2019-9621 | Zimbra Collaboration Suite (ZCS) Synacor Zimbra Collaboration Suite (ZCS) contains a server-side request forgery (SSRF) vulnerability via the ProxyServlet component. | 2025-07-28 | — | |
| 2025-05-19 | CVE-2024-27443 | Zimbra Collaboration Suite (ZCS) Zimbra Collaboration contains a cross-site scripting (XSS) vulnerability in the CalendarInvite feature of the Zimbra webmail classic user interface. An attacker can exploit this vulnerability via an email message cont… | 2025-06-09 | — | |
| 2025-02-25 | CVE-2023-34192 | Zimbra Collaboration Suite (ZCS) Synacor Zimbra Collaboration Suite (ZCS) contains a cross-site scripting (XSS) vulnerability that allows a remote authenticated attacker to execute arbitrary code via a crafted script to the /h/autoSaveDraft function. | 2025-03-18 | — | |
| 2024-10-03 | CVE-2024-45519 | Zimbra Collaboration Suite (ZCS) Synacor Zimbra Collaboration Suite (ZCS) contains an unspecified vulnerability in the postjournal service that may allow an unauthenticated user to execute commands. | 2024-10-24 | — | |
| 2023-07-27 | CVE-2023-37580 | Zimbra Collaboration Suite (ZCS) Synacor Zimbra Collaboration Suite (ZCS) contains a cross-site scripting vulnerability impacting the confidentiality and integrity of data. | 2023-08-17 | — | |
| 2023-04-03 | CVE-2022-27926 | Zimbra Collaboration Suite (ZCS) Synacor Zimbra Collaboration Suite (ZCS) contains a cross-site scripting vulnerability by allowing an endpoint URL to accept parameters without sanitizing. | 2023-04-24 | — | |
| 2022-10-20 | CVE-2022-41352 | Zimbra Collaboration Suite (ZCS) Synacor Zimbra Collaboration Suite (ZCS) allows an attacker to upload arbitrary files using cpio package to gain incorrect access to any other user accounts. | 2022-11-10 | Ransomware | — |
| 2022-08-11 | CVE-2022-37042 | Zimbra Collaboration Suite (ZCS) Synacor Zimbra Collaboration Suite (ZCS) contains an authentication bypass vulnerability in MailboxImportServlet. This vulnerability was chained with CVE-2022-27925 which allows for unauthenticated remote code execution. | 2022-09-01 | Ransomware | — |
| 2022-08-11 | CVE-2022-27925 | Zimbra Collaboration Suite (ZCS) Synacor Zimbra Collaboration Suite (ZCS) contains flaw in the mboximport functionality, allowing an authenticated attacker to upload arbitrary files to perform remote code execution. This vulnerability was chained wit… | 2022-09-01 | Ransomware | — |
| 2022-08-04 | CVE-2022-27924 | Zimbra Collaboration Suite (ZCS) Synacor Zimbra Collaboration Suite (ZCS) allows an attacker to inject memcache commands into a targeted instance which causes an overwrite of arbitrary cached entries. | 2022-08-25 | Ransomware | — |
| 2022-04-19 | CVE-2018-6882 | Zimbra Collaboration Suite (ZCS) Synacor Zimbra Collaboration Suite (ZCS) contains a cross-site scripting vulnerability that might allow remote attackers to inject arbitrary web script or HTML. | 2022-05-10 | Ransomware | — |
| 2022-02-25 | CVE-2022-24682 | Zimbra Collaborate Suite (ZCS) Synacor Zimbra Collaboration Suite (ZCS) contains a cross-site scripting (XSS) vulnerability in the Calendar feature that allows an attacker to execute arbitrary code. | 2022-03-11 | Ransomware | — |
| 2022-01-10 | CVE-2019-9670 | Zimbra Collaboration Suite (ZCS) Synacor Zimbra Collaboration Suite (ZCS) contains an improper restriction of XML external entity (XXE) vulnerability in the mailboxd component. | 2022-07-10 | — |
Source: CISA Known Exploited Vulnerabilities catalog (public data). Descriptions are CISA's, shortened. Always check the vendor advisory before acting. cisa.gov
Before you patch: three checks
- 01Match the exact version and configuration you run against the vendor advisory. Owning the product is not the same as being exposed.
- 02Check reachability: an exploited flaw on an interface reachable from the internet, or from a compromised workstation, moves to the front of the queue.
- 03Where CISA flags forensic triage, hunt for compromise as well as patch: a fix does not remove an attacker who got in before it.
Questions
How many Zimbra vulnerabilities are in the CISA KEV catalog?
19 in catalog version 2026.10.21, the first added on 2022-01-10 and the most recent on 2026-08-21. 5 were added in the last 12 months.
Which Zimbra products have the most exploited vulnerabilities?
By KEV entries: Zimbra Collaboration Suite (ZCS) (16), Zimbra Collaboration Suite (ZCS) (1), Zimbra Collaborate Suite (ZCS) (1), Zimbra Collaboration Suite (1).
Are Zimbra vulnerabilities used in ransomware attacks?
CISA marks 6 of the 19 Zimbra entries as known to be used in ransomware campaigns. The table flags them.
Is the next Zimbra CVE exploitable on your network?
A KEV entry says a vulnerability is exploited somewhere. Zero Hunt answers whether it is exploitable in your environment: an autonomous AI red team on an on-premise appliance, running on private AI, black-box or gray-box, with a human approving every step that matters.
Other vendors: Cisco · Microsoft · Fortinet · Linux kernel · Citrix · GitLab · Adobe · Palo Alto Networks · Check Point · Langflow · Arista · Oracle · SonicWall · Ivanti · VMware · SAP · Atlassian · Zyxel · Progress · F5