Login Request a demo
ZC
Product
Zimbra Collaboration Suite
by Synacor · last CVE Oct 23, 2026
On CISA KEVExploited in the wildRansomware-linked
94
CVEs
18
On KEV
9.8
Max CVSS
5
New 30D
Vulnerabilities94In the news12Timeline
Severity mix
Critical 12High 20Medium 59Low 1
Severity
All severities94Critical12High20Medium59Low1
Exploitation
On CISA KEV18Exploited in the wild18
Watch

Add Zimbra Collaboration Suite to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2026-73570
In wildKEV
8.9
72%
Aug 13
Zimbra Collaboration Suite (ZCS) OS Command Injection Vulnerability
Affected: before 10.1.20
CVE-2025-68645
In wildKEV
8.8
49%
Dec 22
Synacor Zimbra Collaboration Suite (ZCS) PHP Remote File Inclusion Vulnerability
Affected: 10.0.0 before 10.0.18; 10.1.0 before 10.1.13
CVE-2022-27924
RansomwareIn wildKEV
7.5
94%
Apr 20
Synacor Zimbra Collaboration Suite (ZCS) Command Injection Vulnerability
Affected: 8.8.15; 8.8.15; 8.8.15; 8.8.15; 8.8.15; 8.8.15; +34 more
CVE-2019-9621
In wildKEV
7.5
81%
Apr 30
Synacor Zimbra Collaboration Suite (ZCS) Server-Side Request Forgery (SSRF) Vulnerability
Affected: before 8.6.0; 8.7.0 before 8.7.11; 8.8.0 before 8.8.9; 8.6.0; 8.6.0; 8.6.0; +34 more
CVE-2022-27925
RansomwareIn wildKEV
7.2
99%
Apr 20
Synacor Zimbra Collaboration Suite (ZCS) Arbitrary File Upload Vulnerability
Affected: 8.8.15; 8.8.15; 8.8.15; 8.8.15; 8.8.15; 8.8.15; +34 more
CVE-2026-33373
8.8
0%
Mar 30
An issue was discovered in Zimbra Collaboration (ZCS) 10.0 and 10.1
Affected: 10.0.0 before 10.0.18; 10.1.0 before 10.1.13
CVE-2025-32354
8.8
0%
Apr 29
In Zimbra Collaboration (ZCS) 9.0 through 10.1, a Cross-Site Request Forgery (CSRF) vulnerability exists in the GraphQL endpoint (/service/extension/graphql) of Zimbra webmail due…
Affected: 9.0.0 before 10.1.4
CVE-2025-25064
8.8
37%
Feb 3
SQL injection vulnerability in the ZimbraSync Service SOAP endpoint in Zimbra Collaboration 10.0.x before 10.0.12 and 10.1.x before 10.1.4 due to insufficient sanitization of a…
Affected: 10.0.0 before 10.0.12; 10.1.0 before 10.1.4
CVE-2015-7610
8.8
1%
May 30
Cross-site request forgery (CSRF) vulnerability in the login form in Zimbra Collaboration Suite (aka ZCS) before 8.6.0 Patch 10, 8.7.x before 8.7.11 Patch 2, and 8.8.x before…
Affected: 8.7.0 through 8.7.11; 8.8.0 through 8.8.8; 8.6.0; 8.7.11
CVE-2016-3403
8.8
1%
May 17
Multiple cross-site request forgery (CSRF) vulnerabilities in the Admin Console in Zimbra Collaboration before 8.6.0 Patch 8 allow remote attackers to hijack the authentication of…
Affected: through 8.6.0
CVE-2016-3406
8.8
1%
Jan 18
Multiple cross-site request forgery (CSRF) vulnerabilities in Zimbra Collaboration before 8.7.0 allow remote attackers to hijack the authentication of unspecified victims via…
Affected: through 8.6.0
CVE-2020-12846
8.0
3%
Jun 3
Zimbra before 8.8.15 Patch 10 and 9.x before 9.0.0 Patch 3 allows remote code execution via an avatar file
Affected: before 8.8.15; 8.8.15; 8.8.15; 8.8.15; 8.8.15; 8.8.15; +8 more
CVE-2022-3569
7.8
1%
Oct 17
Due to an issue with incorrect sudo permissions, Zimbra Collaboration Suite (ZCS) suffers from a local privilege escalation issue in versions 9.0.0 and prior, where the 'zimbra'…
Affected: through 9.0.0
CVE-2024-54663
7.5
1%
Dec 19
An issue was discovered in the Webmail Classic UI in Zimbra Collaboration (ZCS) 9.0 and 10.0 and 10.1
Affected: 9.0.0 before 10.0.11; 10.1.0 before 10.1.3
CVE-2016-4019
7.5
2%
Jan 18
Unspecified vulnerability in Zimbra Collaboration before 8.7.0 allows remote attackers to affect integrity via unknown vectors, aka bug 104477
Affected: through 8.6.0
CVE-2016-3413
7.5
2%
Jan 18
Unspecified vulnerability in Zimbra Collaboration before 8.7.0 allows remote attackers to affect integrity via unknown vectors, aka bug 103996
Affected: through 8.6.0
CVE-2016-3405
7.5
2%
Jan 18
Multiple unspecified vulnerabilities in Zimbra Collaboration before 8.7.0 allow remote attackers to affect integrity via unknown vectors, aka bugs 103961 and 104828
Affected: through 8.6.0
CVE-2016-3404
7.5
2%
Jan 18
Unspecified vulnerability in Zimbra Collaboration before 8.7.0 allows remote attackers to affect integrity via unknown vectors, aka bug 103959
Affected: through 8.6.0
CVE-2016-3402
7.5
2%
Jan 18
Unspecified vulnerability in Zimbra Collaboration before 8.7.0 allows remote attackers to affect confidentiality via unknown vectors, aka bug 99167
Affected: through 8.6.0
CVE-2026-93631
New
7.1
0%
Oct 23
Zimbra Collaboration Suite OAuth Extension Cross-Site Request Forgery Enables Account Linking
Affected: through 10.1.20
Showing 20