https://patchfirst.co/vendor/synacor/New and newly exploited Synacor CVEs, with CISA KEV, EPSS and ATT&CK context. Newest 50 by publication or KEV listing.en-gb360Sat, 31 Oct 2026 05:11:25 GMThttps://patchfirst.co/cve/CVE-2026-73570/CVE-2026-73570#kevFri, 21 Aug 2026 00:00:00 GMTSynacor · Zimbra Collaboration Suite (ZCS). In CISA KEV since 2026-08-21. ENISA EUVD lists it as exploited. EPSS 71.7% (higher than 99.42% of CVEs). CVSS 8.9 HIGH. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter. Priority 79.1 of 100.kevpublic-exploitT1190T1059https://patchfirst.co/cve/CVE-2025-48700/CVE-2025-48700#kevMon, 20 Apr 2026 00:00:00 GMTSynacor · Zimbra Collaboration Suite (ZCS). In CISA KEV since 2026-04-20. ENISA EUVD lists it as exploited. EPSS 1.7% (higher than 77.4% of CVEs). CVSS 6.1 MEDIUM. ATT&CK: T1566.002 Spearphishing Link; T1056 Input Capture; T1059.007 JavaScript. Priority 62.7 of 100.kevT1566.002T1056T1059.007https://patchfirst.co/cve/CVE-2025-66376/CVE-2025-66376#kevWed, 18 Mar 2026 00:00:00 GMTSynacor · Zimbra Collaboration Suite (ZCS). In CISA KEV since 2026-03-18. ENISA EUVD lists it as exploited. EPSS 20.2% (higher than 97.5% of CVEs). CVSS 6.1 MEDIUM. ATT&CK: T1566.001 Spearphishing Attachment; T1059.007 JavaScript. Priority 66.8 of 100.kevT1566.001T1059.007https://patchfirst.co/cve/CVE-2020-7796/CVE-2020-7796#kevTue, 17 Feb 2026 00:00:00 GMTSynacor · Zimbra Collaboration Suite. In CISA KEV since 2026-02-17. ENISA EUVD lists it as exploited. EPSS 93.6% (higher than 99.84% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1090 Proxy. Priority 69.8 of 100.kevpublic-exploitT1190T1090https://patchfirst.co/cve/CVE-2025-68645/CVE-2025-68645#kevThu, 22 Jan 2026 00:00:00 GMTSynacor · Zimbra Collaboration Suite (ZCS). In CISA KEV since 2026-01-22. ENISA EUVD lists it as exploited. EPSS 48.9% (higher than 98.9% of CVEs). CVSS 8.8 HIGH. Public exploit code exists. ATT&CK: T1005 Data from Local System. Priority 73.9 of 100.kevpublic-exploitT1005https://patchfirst.co/cve/CVE-2025-27915/CVE-2025-27915#kevTue, 07 Oct 2025 00:00:00 GMTSynacor · Zimbra Collaboration Suite (ZCS). In CISA KEV since 2025-10-07. ENISA EUVD lists it as exploited. EPSS 4.1% (higher than 90.7% of CVEs). CVSS 5.4 MEDIUM. Public exploit code exists. ATT&CK: T1566 Phishing; T1059 Command and Scripting Interpreter. Priority 64.9 of 100.kevpublic-exploitT1566T1059https://patchfirst.co/cve/CVE-2019-9621/CVE-2019-9621#kevMon, 07 Jul 2025 00:00:00 GMTSynacor · Zimbra Collaboration Suite (ZCS). In CISA KEV since 2025-07-07. ENISA EUVD lists it as exploited. EPSS 81.0% (higher than 99.63% of CVEs). CVSS 7.5 HIGH. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1090 Proxy. Priority 68.2 of 100.kevpublic-exploitT1190T1090https://patchfirst.co/cve/CVE-2024-27443/CVE-2024-27443#kevMon, 19 May 2025 00:00:00 GMTSynacor · Zimbra Collaboration Suite (ZCS). In CISA KEV since 2025-05-19. ENISA EUVD lists it as exploited. EPSS 24.6% (higher than 97.9% of CVEs). CVSS 6.1 MEDIUM. Public exploit code exists. ATT&CK: T1566.002 Spearphishing Link; T1059.004 Unix Shell; T1114 Email Collection; T1041 Exfiltration Over C2 Channel. Priority 66.8 of 100.kevpublic-exploitT1566.002T1059.004T1114T1041https://patchfirst.co/cve/CVE-2023-34192/CVE-2023-34192#kevTue, 25 Feb 2025 00:00:00 GMTSynacor · Zimbra Collaboration Suite (ZCS). In CISA KEV since 2025-02-25. ENISA EUVD lists it as exploited. EPSS 77.3% (higher than 99.56% of CVEs). CVSS 9.0 CRITICAL. Public exploit code exists. ATT&CK: T1055 Process Injection; T1059 Command and Scripting Interpreter; T1185 Browser Session Hijacking. Priority 69.2 of 100.kevpublic-exploitT1055T1059T1185https://patchfirst.co/cve/CVE-2024-45519/CVE-2024-45519#kevThu, 03 Oct 2024 00:00:00 GMTSynacor · Zimbra Collaboration Suite (ZCS). In CISA KEV since 2024-10-03. ENISA EUVD lists it as exploited. EPSS 99.9% (higher than 99.97% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter. Priority 69.9 of 100.kevpublic-exploitT1190T1059https://patchfirst.co/cve/CVE-2023-37580/CVE-2023-37580Mon, 31 Jul 2023 00:00:00 GMTSynacor · Zimbra Collaboration Suite (ZCS). In CISA KEV since 2023-07-27. ENISA EUVD lists it as exploited. EPSS 49.1% (higher than 98.9% of CVEs). CVSS 6.1 MEDIUM. Public exploit code exists. ATT&CK: T1204.001 Malicious Link; T1059.007 JavaScript. Priority 67.0 of 100.kevpublic-exploitT1204.001T1059.007https://patchfirst.co/cve/CVE-2022-27926/CVE-2022-27926#kevMon, 03 Apr 2023 00:00:00 GMTSynacor · Zimbra Collaboration Suite (ZCS). In CISA KEV since 2023-04-03. ENISA EUVD lists it as exploited. EPSS 17.6% (higher than 97.1% of CVEs). CVSS 6.1 MEDIUM. Public exploit code exists. ATT&CK: T1189 Drive-by Compromise; T1059.007 JavaScript. Named in 1 threat report. Priority 70.6 of 100.kevpublic-exploitT1189T1059.007https://patchfirst.co/cve/CVE-2022-41352/CVE-2022-41352#kevThu, 20 Oct 2022 00:00:00 GMTSynacor · Zimbra Collaboration Suite (ZCS). In CISA KEV since 2022-10-20, known ransomware use. ENISA EUVD lists it as exploited. EPSS 95.5% (higher than 99.87% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1505.003 Web Shell. Priority 79.8 of 100.kevransomwarepublic-exploitT1190T1505.003https://patchfirst.co/cve/CVE-2022-37042/CVE-2022-37042Fri, 12 Aug 2022 00:00:00 GMTSynacor · Zimbra Collaboration Suite (ZCS). In CISA KEV since 2022-08-11, known ransomware use. ENISA EUVD lists it as exploited. EPSS 92.1% (higher than 99.82% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter. Priority 79.8 of 100.kevransomwarepublic-exploitT1190T1059https://patchfirst.co/cve/CVE-2022-27925/CVE-2022-27925#kevThu, 11 Aug 2022 00:00:00 GMTSynacor · Zimbra Collaboration Suite (ZCS). In CISA KEV since 2022-08-11, known ransomware use. ENISA EUVD lists it as exploited. EPSS 98.7% (higher than 99.92% of CVEs). CVSS 7.2 HIGH. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1005 Data from Local System. Priority 78.0 of 100.kevransomwarepublic-exploitT1190T1005https://patchfirst.co/cve/CVE-2022-27924/CVE-2022-27924#kevThu, 04 Aug 2022 00:00:00 GMTSynacor · Zimbra Collaboration Suite (ZCS). In CISA KEV since 2022-08-04, known ransomware use. ENISA EUVD lists it as exploited. EPSS 93.9% (higher than 99.84% of CVEs). CVSS 7.5 HIGH. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1565.001 Stored Data Manipulation. Priority 78.2 of 100.kevransomwarepublic-exploitT1190T1565.001https://patchfirst.co/cve/CVE-2018-6882/CVE-2018-6882#kevTue, 19 Apr 2022 00:00:00 GMTSynacor · Zimbra Collaboration Suite (ZCS). In CISA KEV since 2022-04-19, known ransomware use. ENISA EUVD lists it as exploited. EPSS 29.8% (higher than 98.2% of CVEs). CVSS 6.1 MEDIUM. Public exploit code exists. ATT&CK: T1566.002 Spearphishing Link; T1059 Command and Scripting Interpreter. Priority 76.9 of 100.kevransomwarepublic-exploitT1566.002T1059https://patchfirst.co/cve/CVE-2022-24682/CVE-2022-24682#kevFri, 25 Feb 2022 00:00:00 GMTSynacor · Zimbra Collaborate Suite (ZCS). In CISA KEV since 2022-02-25, known ransomware use. ENISA EUVD lists it as exploited. EPSS 30.9% (higher than 98.3% of CVEs). CVSS 6.1 MEDIUM. Public exploit code exists. ATT&CK: T1204.001 Malicious Link; T1059.007 JavaScript; T1185 Browser Session Hijacking. Priority 76.9 of 100.kevransomwarepublic-exploitT1204.001T1059.007T1185https://patchfirst.co/cve/CVE-2019-9670/CVE-2019-9670#kevMon, 10 Jan 2022 00:00:00 GMTSynacor · Zimbra Collaboration Suite (ZCS). In CISA KEV since 2022-01-10. ENISA EUVD lists it as exploited. EPSS >99.9% (higher than 99.98% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1005 Data from Local System. Named in 2 threat reports. Priority 76.0 of 100.kevpublic-exploitT1190T1005