ACTIVELY EXPLOITED
CVE-2019-9670: Synacor Zimbra Collaboration Suite (ZCS) Improper Restriction of XML External Entity Reference
| Vendor | Synacor |
|---|---|
| Product | Zimbra Collaboration Suite (ZCS) |
| Actively exploited | Yes |
| Added to CISA KEV | 10 Jan 2022 |
| CISA federal deadline | 10 Jul 2022 |
| Weakness (CWE) | CWE-611 |
Required action (CISA's text)
Apply updates per vendor instructions.
Description (NVD)
Synacor Zimbra Collaboration Suite (ZCS) contains an improper restriction of XML external entity (XXE) vulnerability in the mailboxd component.
SOURCES
Other Synacor flaws
- CVE-2026-73570: Zimbra Collaboration Suite (ZCS) OS Command Injection Vulnerability
- CVE-2025-48700: Synacor Zimbra Collaboration Suite (ZCS) Cross-site Scripting Vulnerability
- CVE-2025-66376: Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting Vulnerability
- CVE-2020-7796: Synacor Zimbra Collaboration Suite (ZCS) Server-Side Request Forgery Vulnerability
- CVE-2025-68645: Synacor Zimbra Collaboration Suite (ZCS) PHP Remote File Inclusion Vulnerability
Data from NVD, CISA KEV, FIRST EPSS and vendor advisories. Updated 10 Nov 2026.