VendorsEnterprise apps
Zimbra (Synacor)
Zimbra, owned by Synacor, makes the Zimbra Collaboration Suite email and calendar server, sold as open-source and network editions.
- Response trend, 6 months
- Not enough history
- Open now
- None
- Latest incident
- 7 Jul 2026
- Incidents on record
- 9
Response to exploited bugs
Not rated. 1 reviewed zero-day on record. A grade needs at least 3.
Fixing privately reported bugs
Not rated. 1 private report on record. A grade needs at least 3.
What a grade means. B means the vendor met the public norm, such as a first fix within 7 days of the first public report or a private fix within 120 days. Taking half the norm time scores 92, an A. Taking twice the norm time scores 43, a D−. How grades work
Why these grades
Every clock starts at the first public report.
- Response to exploited bugs: not rated. 1 reviewed zero-day in the last 36 months. A grade needs at least 3.
- First fix within a day, for its one reviewed zero-day.
- Every supported version fixed within a day, for its one reviewed zero-day.
- First advisory within a day, for its one reviewed zero-day.
- Fixing privately reported bugs: not rated, a grade needs 3 cases. Median 128 days from private report to ZDI's public advisory (1 case). 1 of 1 took longer than ZDI's 120-day deadline.
- 5 of 6 reviewed exploited bugs had a public fix before exploitation was reported. They do not count toward the response grade. For 2 of them, fixes for every version came later, up to 189 days.
- NR (not rated) means a subject has fewer than 3 data points from the last 36 months, or their recency weights add up to less than one current data point. For response, a data point is a reviewed exploited zero-day. For private fixes, it is a private report (one vendor, one report date). KEV listings alone never rate a vendor. A grade is provisional when the vendor's own evidence does not yet outweigh the starting value, or confidence is below medium.
Response to exploited bugs: sub-scores
- Time to first advisory1 zero-day, within a day781 case, low confidence, not used for this vendor
- Time to first fix1 zero-day, within a day781 case, low confidence, not used for this vendor
- Time to fix all versions1 zero-day, within a day781 case, low confidence, not used for this vendor
- OpennessAdvisories available by RSS. 1 of 1 fixed zero-day with a public fix date for every version.644 cases, low confidence, not used for this vendor
Fixing privately reported bugs: sub-score
- Private fix speedMedian 128 days from private report to ZDI's public advisory (1 case)751 case, low confidence, not used for this vendor
Response fingerprint
Median of 1 graded zero-days. Vendor statement 0h, first fix 0h, all versions 0h.
Counts toward the response grade 1
- 6 Nov 2025Zimbra Classic UI stored XSS via CSS @import, used by a Russian espionage group (CVE-2025-66376)
Not graded 8: n-days, unreviewed timelines and end-of-life products
- 7 Jul 2026Zimbra SNMP notification command injection (CVE-2026-73570)Not graded: n-day
- 6 Nov 2025Zimbra Webmail RestFilter unauthenticated local file inclusion (CVE-2025-68645)Not graded: n-day
- 27 Jan 2025Zimbra Classic Web Client stored XSS via ICS calendar files (CVE-2025-27915)Not graded: unclear
- 17 Dec 2024Zimbra Classic UI cross-site scripting via crafted HTML (CVE-2025-48700)Not graded: n-day
- 28 Feb 2024Zimbra CalendarInvite cross-site scripting used in Sednit's Operation RoundPress (CVE-2024-27443)Not graded: n-day
- 30 May 2023Zimbra 8.8.15 cross-site scripting in /h/autoSaveDraft (CVE-2023-34192)Not graded: n-day
- 10 Feb 2020Zimbra WebEx zimlet server-side request forgery (CVE-2020-7796)Not graded: n-day
- 13 Mar 2019Zimbra ProxyServlet server-side request forgery used in pre-auth RCE chains (CVE-2019-9621)Not graded: n-day
- Vendor silent
- Vendor statement, no fix
- Fixed for some versions
- Open, no fix
- Open, partly fixed
- Fixed when disclosed
- Date only, no time of day
One row per exploited incident, newest first. A tick at the start means a fix existed when the bug went public.
Exploited incidents
9 in 24 months, 0 with known ransomware use, 13% exploited before a fix
Private reports
Median 128 days, 100% over 120 days, 0 published unpatched
Bugs reported privately to Zimbra (Synacor) by ZDI or Project Zero.
| Published | Advisory | Product | Days from report to fix or to publication. Tick: ZDI's 120-day deadline. | Patch at publication |
|---|---|---|---|---|
| 11 Oct 2024 | ZDI-24-1369CVE-2024-9665 | Zimbra | 128to publication | Yes |
Grade history
Response to exploited bugs: score at the end of each month.
Not rated at any point in this period.
Channels
Get Zimbra (Synacor)'s own alerts
- RSSZimbra blog feedAdd the advisory feed to a feed reader or chat integration.
- RSSZimbra forums: announcements feedAdd the advisory feed to a feed reader or chat integration.
- Advisory pageZimbra Security Center / Security Advisories (wiki)Check the advisory page. It has no push channel.
Grade not rated.