ACTIVELY EXPLOITED
CVE-2024-45519: Synacor Zimbra Collaboration Suite (ZCS) Command Execution Vulnerability
| Vendor | Synacor |
|---|---|
| Product | Zimbra Collaboration Suite (ZCS) |
| Actively exploited | Yes |
| Added to CISA KEV | 3 Oct 2024 |
| CISA federal deadline | 24 Oct 2024 |
| Weakness (CWE) | CWE-284 |
Required action (CISA's text)
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Description (NVD)
Synacor Zimbra Collaboration Suite (ZCS) contains an unspecified vulnerability in the postjournal service that may allow an unauthenticated user to execute commands.
SOURCES
Other Synacor flaws
- CVE-2026-73570: Zimbra Collaboration Suite (ZCS) OS Command Injection Vulnerability
- CVE-2025-48700: Synacor Zimbra Collaboration Suite (ZCS) Cross-site Scripting Vulnerability
- CVE-2025-66376: Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting Vulnerability
- CVE-2020-7796: Synacor Zimbra Collaboration Suite (ZCS) Server-Side Request Forgery Vulnerability
- CVE-2025-68645: Synacor Zimbra Collaboration Suite (ZCS) PHP Remote File Inclusion Vulnerability
Data from NVD, CISA KEV, FIRST EPSS and vendor advisories. Updated 10 Nov 2026.