ZC
Product
Zimbra Collaboration Suite
On CISA KEVExploited in the wildRansomware-linked
89
CVEs
18
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 12High 19Medium 55Low 1
Watch
Add Zimbra Collaboration Suite to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2024-45519 In wildKEV | 9.8 | Oct 2 | Synacor Zimbra Collaboration Suite (ZCS) Command Execution Vulnerability Affected: before 8.8.15; 10.0.0 before 10.0.9; 8.8.15; 8.8.15; 8.8.15; 8.8.15; +34 more |
| CVE-2022-41352 RansomwareIn wildKEV | 9.8 | Sep 26 | Synacor Zimbra Collaboration Suite (ZCS) Arbitrary File Upload Vulnerability Affected: 9.0.0; 9.0.0; 9.0.0; 9.0.0; 9.0.0; 9.0.0; +34 more |
| CVE-2022-37042 RansomwareIn wildKEV | 9.8 | Aug 11 | Synacor Zimbra Collaboration Suite (ZCS) Authentication Bypass Vulnerability Affected: 8.8.15; 8.8.15; 8.8.15; 8.8.15; 8.8.15; 8.8.15; +34 more |
| CVE-2020-7796 In wildKEV | 9.8 | Feb 18 | Synacor Zimbra Collaboration Suite (ZCS) Server-Side Request Forgery Vulnerability Affected: before 8.8.15; 8.8.15; 8.8.15; 8.8.15; 8.8.15; 8.8.15; +2 more |
| CVE-2019-9670 In wildKEV | 9.8 | May 29 | Synacor Zimbra Collaboration Suite (ZCS) Improper Restriction of XML External Entity Reference Affected: 8.7.0 before 8.7.11; 8.7.11; 8.7.11; 8.7.11; 8.7.11; 8.7.11; +5 more |
| CVE-2023-34192 In wildKEV | 9.0 | Jul 6 | Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) Vulnerability Affected: 8.8.15; 8.8.15; 8.8.15; 8.8.15; 8.8.15; 8.8.15; +34 more |
| CVE-2026-73570 In wildKEV | 8.9 | Aug 13 | Zimbra Collaboration Suite (ZCS) OS Command Injection Vulnerability Affected: before 10.1.20 |
| CVE-2025-68645 In wildKEV | 8.8 | Dec 22 | Synacor Zimbra Collaboration Suite (ZCS) PHP Remote File Inclusion Vulnerability Affected: 10.0.0 before 10.0.18; 10.1.0 before 10.1.13 |
| CVE-2022-27924 RansomwareIn wildKEV | 7.5 | Apr 20 | Synacor Zimbra Collaboration Suite (ZCS) Command Injection Vulnerability Affected: 8.8.15; 8.8.15; 8.8.15; 8.8.15; 8.8.15; 8.8.15; +34 more |
| CVE-2019-9621 In wildKEV | 7.5 | Apr 30 | Synacor Zimbra Collaboration Suite (ZCS) Server-Side Request Forgery (SSRF) Vulnerability Affected: before 8.6.0; 8.7.0 before 8.7.11; 8.8.0 before 8.8.9; 8.6.0; 8.6.0; 8.6.0; +34 more |
| CVE-2022-27925 RansomwareIn wildKEV | 7.2 | Apr 20 | Synacor Zimbra Collaboration Suite (ZCS) Arbitrary File Upload Vulnerability Affected: 8.8.15; 8.8.15; 8.8.15; 8.8.15; 8.8.15; 8.8.15; +34 more |
| CVE-2025-66376 In wildKEV | 6.1 | Jan 5 | Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting Vulnerability Affected: 10.0.0 before 10.0.18; 10.1.0 before 10.1.13 |
| CVE-2025-48700 In wildKEV | 6.1 | Jun 23 | Synacor Zimbra Collaboration Suite (ZCS) Cross-site Scripting Vulnerability Affected: 10.0.0 before 10.0.12; 10.1.0 before 10.1.4; 8.8.15; 8.8.15; 8.8.15; 8.8.15; +34 more |
| CVE-2023-37580 In wildKEV | 6.1 | Jul 31 | Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) Vulnerability Affected: 8.8.0 before 8.8.15; 8.8.15; 8.8.15; 8.8.15; 8.8.15; 8.8.15; +8 more |
| CVE-2022-27926 In wildKEV | 6.1 | Apr 20 | Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) Vulnerability Affected: 9.0.0; 9.0.0; 9.0.0; 9.0.0; 9.0.0; 9.0.0; +18 more |
| CVE-2022-24682 RansomwareIn wildKEV | 6.1 | Feb 9 | Synacor Zimbra Collaborate Suite (ZCS) Cross-Site Scripting Vulnerability Affected: 8.8.0 before 8.8.15; 8.8.15; 8.8.15; 8.8.15; 8.8.15; 8.8.15; +25 more |
| CVE-2018-6882 RansomwareIn wildKEV | 6.1 | Mar 27 | Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) Vulnerability Affected: before 8.7.0; 8.7.0; 8.8.0; 8.8.1; 8.8.2; 8.8.3; +3 more |
| CVE-2025-27915 In wildKEV | 5.4 | Mar 12 | Synacor Zimbra Collaboration Suite (ZCS) Cross-site Scripting Vulnerability Affected: 10.0.0 before 10.0.13; 10.1.0 before 10.1.5; 9.0.0; 9.0.0; 9.0.0; 9.0.0; +34 more |
| CVE-2019-6980 | 9.8 | May 29 | Synacor Zimbra Collaboration Suite 8.7.x through 8.8.11 allows insecure object deserialization in the IMAP component Affected: 8.7.0 before 8.7.11; 8.8.0 before 8.8.9; 8.7.11; 8.7.11; 8.7.11; 8.7.11; +20 more |
| CVE-2018-20160 | 9.8 | May 29 | ZxChat (aka ZeXtras Chat), as used for zimbra-chat and zimbra-talk in Synacor Zimbra Collaboration Suite 8.7 and 8.8 and in other products, allows XXE attacks, as demonstrated by… Affected: 8.7.0 before 8.7.11; 8.8.0 before 8.8.9; 8.7.11; 8.7.11; 8.7.11; 8.7.11; +19 more |
| CVE-2017-6821 | 9.8 | May 23 | Directory traversal vulnerability in Zimbra Collaboration Suite (aka ZCS) before 8.7.6 allows attackers to have unspecified impact via unknown vectors Affected: through 8.7.5 |
| CVE-2017-6813 | 9.8 | May 23 | A service provided by Zimbra Collaboration Suite (ZCS) before 8.7.6 fails to require needed privileges before performing a few requested operations Affected: through 8.7.5 |
| CVE-2016-9924 | 9.8 | Mar 29 | Zimbra Collaboration Suite (ZCS) before 8.7.4 allows remote attackers to conduct XML External Entity (XXE) attacks Affected: through 8.7.3 |
| CVE-2016-3415 | 9.1 | Jan 18 | Zimbra Collaboration before 8.7.0 allows remote attackers to conduct deserialization attacks via unspecified vectors, aka bug 102276 Affected: through 8.6.0 |
| CVE-2026-33373 | 8.8 | Mar 30 | An issue was discovered in Zimbra Collaboration (ZCS) 10.0 and 10.1 Affected: 10.0.0 before 10.0.18; 10.1.0 before 10.1.13 |
| CVE-2025-32354 | 8.8 | Apr 29 | In Zimbra Collaboration (ZCS) 9.0 through 10.1, a Cross-Site Request Forgery (CSRF) vulnerability exists in the GraphQL endpoint (/service/extension/graphql) of Zimbra webmail due… Affected: 9.0.0 before 10.1.4 |
| CVE-2025-25064 | 8.8 | Feb 3 | SQL injection vulnerability in the ZimbraSync Service SOAP endpoint in Zimbra Collaboration 10.0.x before 10.0.12 and 10.1.x before 10.1.4 due to insufficient sanitization of a… Affected: 10.0.0 before 10.0.12; 10.1.0 before 10.1.4 |
| CVE-2015-7610 | 8.8 | May 30 | Cross-site request forgery (CSRF) vulnerability in the login form in Zimbra Collaboration Suite (aka ZCS) before 8.6.0 Patch 10, 8.7.x before 8.7.11 Patch 2, and 8.8.x before… Affected: 8.7.0 through 8.7.11; 8.8.0 through 8.8.8; 8.6.0; 8.7.11 |
| CVE-2016-3403 | 8.8 | May 17 | Multiple cross-site request forgery (CSRF) vulnerabilities in the Admin Console in Zimbra Collaboration before 8.6.0 Patch 8 allow remote attackers to hijack the authentication of… Affected: through 8.6.0 |
| CVE-2016-3406 | 8.8 | Jan 18 | Multiple cross-site request forgery (CSRF) vulnerabilities in Zimbra Collaboration before 8.7.0 allow remote attackers to hijack the authentication of unspecified victims via… Affected: through 8.6.0 |
| CVE-2020-12846 | 8.0 | Jun 3 | Zimbra before 8.8.15 Patch 10 and 9.x before 9.0.0 Patch 3 allows remote code execution via an avatar file Affected: before 8.8.15; 8.8.15; 8.8.15; 8.8.15; 8.8.15; 8.8.15; +8 more |
| CVE-2022-3569 | 7.8 | Oct 17 | Due to an issue with incorrect sudo permissions, Zimbra Collaboration Suite (ZCS) suffers from a local privilege escalation issue in versions 9.0.0 and prior, where the 'zimbra'… Affected: through 9.0.0 |
| CVE-2024-54663 | 7.5 | Dec 19 | An issue was discovered in the Webmail Classic UI in Zimbra Collaboration (ZCS) 9.0 and 10.0 and 10.1 Affected: 9.0.0 before 10.0.11; 10.1.0 before 10.1.3 |
| CVE-2016-4019 | 7.5 | Jan 18 | Unspecified vulnerability in Zimbra Collaboration before 8.7.0 allows remote attackers to affect integrity via unknown vectors, aka bug 104477 Affected: through 8.6.0 |
| CVE-2016-3413 | 7.5 | Jan 18 | Unspecified vulnerability in Zimbra Collaboration before 8.7.0 allows remote attackers to affect integrity via unknown vectors, aka bug 103996 Affected: through 8.6.0 |
| CVE-2016-3405 | 7.5 | Jan 18 | Multiple unspecified vulnerabilities in Zimbra Collaboration before 8.7.0 allow remote attackers to affect integrity via unknown vectors, aka bugs 103961 and 104828 Affected: through 8.6.0 |
| CVE-2016-3404 | 7.5 | Jan 18 | Unspecified vulnerability in Zimbra Collaboration before 8.7.0 allows remote attackers to affect integrity via unknown vectors, aka bug 103959 Affected: through 8.6.0 |
| CVE-2016-3402 | 7.5 | Jan 18 | Unspecified vulnerability in Zimbra Collaboration before 8.7.0 allows remote attackers to affect confidentiality via unknown vectors, aka bug 99167 Affected: through 8.6.0 |
| CVE-2026-73576 | 6.5 | Aug 13 | In Zimbra Collaboration (ZCS) before 10.1.17, weak cryptographic key generation vulnerability exists in the OnlyOffice integration Affected: before 10.1.17 |
| CVE-2026-73574 | 6.5 | Aug 13 | In Zimbra Collaboration before 10.1.17, a local file inclusion (LFI) vulnerability exists in the Zimbra Classic Web Client due to improper validation of the fu request parameter Affected: before 10.1.17 |
| CVE-2026-73573 | 6.5 | Aug 13 | In Zimbra Collaboration (ZCS) before 10.1.17, a path traversal vulnerability exists in the Zimbra Briefcase document editing functionality due to improper validation of the… Affected: before 10.1.17 |
| CVE-2019-6981 | 6.5 | May 29 | Zimbra Collaboration Suite 8.7.x through 8.8.11 allows Blind SSRF in the Feed component Affected: 8.7.0 before 8.7.11; 8.8.0 before 8.8.9; 8.7.11; 8.7.11; 8.7.11; 8.7.11; +22 more |
| CVE-2018-10951 | 6.5 | May 10 | mailboxd in Zimbra Collaboration Suite 8.8 before 8.8.8; 8.7 before 8.7.11.Patch3; and 8.6 before 8.6.0.Patch10 allows zimbraSSLPrivateKey read access via a GetServer,… Affected: 8.7.0 through 8.7.11; 8.8.0 before 8.8.8; 8.6.0; 8.6.0; 8.6.0; 8.6.0; +8 more |
| CVE-2016-3414 | 6.5 | Jan 18 | Unspecified vulnerability in Zimbra Collaboration before 8.6.0 Patch 7 allows remote authenticated users to affect availability via unknown vectors, aka bug 102029 Affected: through 8.6.0 |
| CVE-2016-3401 | 6.5 | Jan 18 | Unspecified vulnerability in Zimbra Collaboration before 8.7.0 allows remote authenticated users to affect integrity via unknown vectors, aka bug 99810 Affected: through 8.6.0 |
| CVE-2026-73572 | 6.1 | Aug 13 | In Zimbra Collaboration (ZCS) before 10.1.17, a stored cross-site scripting (XSS) vulnerability exists in the Zimbra Classic Web Client due to insufficient sanitization of… Affected: before 10.1.17 |
| CVE-2026-33368 | 6.1 | Mar 20 | Zimbra Collaboration Suite (ZCS) 10.0 and 10.1 contains a reflected cross-site scripting (XSS) vulnerability in the Classic Webmail REST interface (/h/rest) Affected: 10.0.0 before 10.1.16 |
| CVE-2026-33370 | 6.1 | Mar 20 | An issue was discovered in Zimbra Collaboration (ZCS) 10.0 and 10.1 Affected: 10.0.0 before 10.1.16 |
| CVE-2024-45516 | 6.1 | May 14 | An issue was discovered in Zimbra Collaboration (ZCS) 9.0.0 before Patch 43, 10.0.x before 10.0.12, 10.1.x before 10.1.4, and 8.8.15 before Patch 47 Affected: 10.0.0 before 10.0.12; 10.1.0 before 10.1.4; 8.8.15; 8.8.15; 8.8.15; 8.8.15; +34 more |
| CVE-2024-50599 | 6.1 | Nov 7 | A reflected Cross-Site Scripting (XSS) vulnerability has been identified in Zimbra Collaboration Suite (ZCS) 8.8.15, affecting one of the webmail calendar endpoints Affected: 8.8.15; 8.8.15; 8.8.15; 8.8.15; 8.8.15; 8.8.15; +34 more |