Actively exploited vulnerabilities affecting Synacor products.https://wildfortech.comhttps://wildfortech.com/security#CVE-2026-73570https://wildfortech.com/security#CVE-2026-73570This vulnerability in Zimbra Collaboration Suite allows an unauthenticated attacker to inject and execute arbitrary operating system commands simply by sending crafted SMTP requests — no login required. Because Zimbra is widely used for enterprise email, a successful exploit could give attackers a foothold on the mail server running as the Zimbra user, potentially enabling data theft, lateral movement, or further compromise of the organization's messaging infrastructure.Fri, 21 Aug 2026 00:00:00 GMTSynacorZimbra Collaboration Suite (ZCS)https://wildfortech.com/security#CVE-2025-48700https://wildfortech.com/security#CVE-2025-48700This cross-site scripting (XSS) flaw in Zimbra Collaboration Suite lets attackers inject and run malicious JavaScript inside a victim's active session. Because Zimbra is a widely used enterprise email and collaboration platform, successful exploitation could allow attackers to steal session tokens, credentials, or other sensitive data without the user's knowledge. Organizations relying on Zimbra for internal or external communication face real risk of account compromise and data exposure.Mon, 20 Apr 2026 00:00:00 GMTSynacorZimbra Collaboration Suite (ZCS)https://wildfortech.com/security#CVE-2025-66376https://wildfortech.com/security#CVE-2025-66376This vulnerability in Zimbra Collaboration Suite's Classic UI allows attackers to inject malicious scripts via CSS @import directives embedded in HTML emails. When a user views a crafted email, the attacker's code can execute in the victim's browser session, potentially enabling session hijacking, credential theft, or further attacks against the user's Zimbra account. Because email is a universal attack surface, any organization running ZCS Classic UI is exposed to phishing-style exploitation without requiring any special user action beyond opening a message.Wed, 18 Mar 2026 00:00:00 GMTSynacorZimbra Collaboration Suite (ZCS)https://wildfortech.com/security#CVE-2020-7796https://wildfortech.com/security#CVE-2020-7796This vulnerability in Zimbra Collaboration Suite allows an attacker to perform server-side request forgery (SSRF) when the WebEx zimlet is installed and its JSP component is enabled. SSRF lets attackers trick the server into making unauthorized requests to internal or external resources, potentially exposing internal services, bypassing network controls, or facilitating further attacks. Organizations running affected ZCS deployments with the WebEx zimlet active are at direct risk.Tue, 17 Feb 2026 00:00:00 GMTSynacorZimbra Collaboration Suitehttps://wildfortech.com/security#CVE-2025-68645https://wildfortech.com/security#CVE-2025-68645This vulnerability in Zimbra Collaboration Suite lets remote attackers manipulate how the server processes requests to its /h/rest endpoint, tricking it into including arbitrary files from the WebRoot directory. Because no authentication barrier is implied as a prerequisite, attackers could potentially read sensitive files or execute malicious code, threatening the confidentiality and integrity of a widely-used enterprise email and collaboration platform.Thu, 22 Jan 2026 00:00:00 GMTSynacor Zimbra Collaboration Suite (ZCS)https://wildfortech.com/security#CVE-2025-27915https://wildfortech.com/security#CVE-2025-27915This vulnerability allows an attacker to embed malicious JavaScript inside a calendar invitation (ICS file) sent via email. When a Zimbra Classic Web Client user opens or previews the message, the script executes automatically within their authenticated session. The attacker can then perform actions as the victim, including creating email filters that silently redirect incoming messages to an attacker-controlled address — enabling ongoing data theft without the victim's knowledge.Tue, 07 Oct 2025 00:00:00 GMTSynacorZimbra Collaboration Suite (ZCS)https://wildfortech.com/security#CVE-2019-9621https://wildfortech.com/security#CVE-2019-9621This vulnerability in Zimbra Collaboration Suite's ProxyServlet component allows an attacker to forge server-side requests, meaning the Zimbra server can be manipulated into making HTTP requests on an attacker's behalf. This can expose internal network resources, bypass access controls, or allow attackers to pivot deeper into an organization's infrastructure — particularly dangerous given how widely ZCS is used as enterprise email and collaboration infrastructure.Mon, 07 Jul 2025 00:00:00 GMTSynacorZimbra Collaboration Suite (ZCS)https://wildfortech.com/security#CVE-2024-27443https://wildfortech.com/security#CVE-2024-27443This vulnerability in Zimbra's classic webmail interface allows attackers to execute arbitrary JavaScript in a victim's browser simply by sending a specially crafted calendar invite email. No user interaction beyond viewing the message is implied — the malicious code runs automatically via a manipulated calendar header. For organizations running Zimbra, this means an attacker could potentially hijack user sessions, steal credentials, or perform actions on behalf of the victim within the webmail application.Mon, 19 May 2025 00:00:00 GMTSynacorZimbra Collaboration Suite (ZCS)