CVE Watch—

CVE-2025-48700

Synacor Zimbra Collaboration Suite (ZCS) Cross-site Scripting Vulnerability

CVSS

—

No CVSS

EPSS

1.7%

p75

KEV

YES

Apr 20, 2026

Exploit Today

0-100

Published: — · Last modified: —

EPSS · 30d

1.7%EPSS · 30 days1.8%

2026-08-022026-08-31

KEV catalog record

Product

Synacor / Zimbra Collaboration Suite (ZCS)

Vulnerability

Synacor Zimbra Collaboration Suite (ZCS) Cross-site Scripting Vulnerability

Added to KEV

Apr 20, 2026

Remediate by

Apr 23, 2026

Known ransomware use

Summary description

Synacor Zimbra Collaboration Suite (ZCS) contains a cross-site scripting vulnerability that could allow attackers to execute arbitrary JavaScript within the user's session, potentially leading to unauthorized access to sensitive information.

Required action

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Notes

https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories ; https://nvd.nist.gov/vuln/detail/CVE-2025-48700

Related CVEs

CVECVSSEPSSKEVRExploitTitleMod.

CVE-2026-735708.9 HIG

97.3%

KEV—79Zimbra Collaboration Suite (ZCS) OS Command Injection Vulnerability7d CVE-2022-370429.8 CRI

99.8%

KEV—80Synacor Zimbra Collaboration Suite (ZCS) Authentication Bypass Vulnerability28d CVE-2022-279257.2 HIG

99.9%

KEV—80Synacor Zimbra Collaboration Suite (ZCS) Arbitrary File Upload Vulnerability28d CVE-2022-279247.5 HIG

99.7%

KEV—80Synacor Zimbra Collaboration Suite (ZCS) Command Injection Vulnerability28d CVE-2018-68826.1 MED

97.8%

KEV—79Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) Vulnerability19d CVE-2024-45519—

100.0%

KEV—80Synacor Zimbra Collaboration Suite (ZCS) Command Execution Vulnerability—