CVE Watch—

CVE-2025-48700

Synacor Zimbra Collaboration Suite (ZCS) Cross-site Scripting Vulnerability

CVSS

—

No CVSS

EPSS

1.7%

p77

KEV

YES

Apr 20, 2026

Exploit Today

0-100

Published: — · Last modified: —

EPSS · 30d

1.7%EPSS · 30 days1.7%

2026-09-172026-10-15

KEV catalog record

Product

Synacor / Zimbra Collaboration Suite (ZCS)

Vulnerability

Synacor Zimbra Collaboration Suite (ZCS) Cross-site Scripting Vulnerability

Added to KEV

Apr 20, 2026

Remediate by

Apr 23, 2026

Known ransomware use

Summary description

Synacor Zimbra Collaboration Suite (ZCS) contains a cross-site scripting vulnerability that could allow attackers to execute arbitrary JavaScript within the user's session, potentially leading to unauthorized access to sensitive information.

Required action

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Notes

https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories ; https://nvd.nist.gov/vuln/detail/CVE-2025-48700

Related CVEs

CVECVSSEPSSKEVRExploitTitleMod.

CVE-2026-735708.9 HIG

99.4%

KEV—80Zimbra Collaboration Suite (ZCS) OS Command Injection Vulnerability53d CVE-2025-663767.2 HIG

97.4%

KEV—79Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting Vulnerability9d CVE-2022-413529.8 CRI

99.9%

KEV—80Synacor Zimbra Collaboration Suite (ZCS) Arbitrary File Upload Vulnerability36d CVE-2022-370429.8 CRI

99.8%

KEV—80Synacor Zimbra Collaboration Suite (ZCS) Authentication Bypass Vulnerability73d CVE-2022-279257.2 HIG

99.9%

KEV—80Synacor Zimbra Collaboration Suite (ZCS) Arbitrary File Upload Vulnerability14d CVE-2022-279247.5 HIG

99.8%

KEV—80Synacor Zimbra Collaboration Suite (ZCS) Command Injection Vulnerability14d