Synacor vulnerabilities & exploitation

Exploitation timeline

Threadlinqs has recorded 7 Synacor CVEs published between 2022-04-15 and 2026-01-15. The busiest month was 2023-07 (1 new CVE). 7 of them (100%) are listed in CISA KEV, which means exploitation in the wild has been confirmed.

Most exploited vulnerabilities

Ranked with CISA KEV listings first, then EPSS exploit probability, then CVSS score. Showing 7 of 7 tracked Synacor CVEs.

• CVE-2024-45519critical 10KEVEPSS 99.9%2024-10-02
• CVE-2022-27925high 7.2KEVRansomwareEPSS 98.2%2022-04-20
• CVE-2022-41352critical 9.8KEVRansomwareEPSS 95.5%2022-09-26
• CVE-2022-37042critical 9.8KEVRansomwareEPSS 91.9%2022-08-11
• CVE-2023-37580medium 6.1KEVEPSS 49.1%2023-07-31
• CVE-2025-66376high 7.2KEVEPSS 20.2%2026-01-05
• CVE-2025-27915medium 5.4KEVEPSS 4%2025-03-12

Products affected

Threadlinqs normalises CPE and CNA product records across all 7 CVEs; 1 distinct Synacor product is affected. The most frequently affected:

• Zimbra Collaboration Suite 7 CVEs

Threat activity

9 tracked threat campaigns reference Synacor products or exploit Synacor CVEs:

• Chinese-speaking threat group UAT-10147 uses agentic AI to automate exploitation of internet-facing web serversHIGH2026-08-21
• Russian TA488 (Void Blizzard / Laundry Bear) Exploits Exchange OWA Zero-Day (CVE-2026-42897) with OWAReaper Backdoor for Long-Term Mailbox AccessCRITICAL2026-07-29
• Operation RoundPress: TA458 Deploys SpyPress Malware via Half-Click Webmail Zero-Days (CVE-2025-27915, CVE-2025-3929, CVE-2026-8496)CRITICAL2026-07-23
• Zimbra Collaboration Suite 10.1.20 Patches Critical Unauthenticated SNMP/Swatchdog Command Injection Plus Six Additional CVEsCRITICAL2026-07-21
• StrikeShark Campaign: SharkLoader Dropper Targets Governments and Software Developers via N-Day Exploits and Trojanized Installers to Deploy Cobalt StrikeHIGH2026-07-11
• Zimbra Collaboration Suite Critical Stored XSS in Classic Web Client (Patched in ZCS 10.1.19)CRITICAL2026-07-10
• SharkLoader Malware Campaign Uses Fake Cisco AnyConnect and Google Update Installers to Deploy Cobalt StrikeHIGH2026-07-03
• SharkLoader Malware Deploys Cobalt Strike Beacon via DLL Side-Loading in StrikeShark CampaignHIGH2026-06-27
• Zimbra Collaboration Suite Stored XSS via CSS @import Active Exploitation (CVE-2025-66376) — Operation GhostMailCRITICAL2026-03-21

Threat actors targeting Synacor

Named threat actors attributed to campaigns that involve Synacor products or CVEs, with the number of linked campaigns:

• StrikeShark 2
• APT28 1
• Void Blizzard 1

How to prioritise Synacor patching

This order follows the data Threadlinqs holds for Synacor, not a generic severity checklist:

• 7 of 7 Synacor CVEs (100%) are in CISA KEV: treat them as actively exploited and remediate them first, starting with CVE-2024-45519, CVE-2022-27925, CVE-2022-41352.
• 3 CVEs are known to be used in ransomware campaigns; patch these ahead of other KEV entries on internet-facing systems.
• 3 CVEs score Critical and 2 High on CVSS v3 (maximum 10, average 7.9); sequence these after KEV and high-EPSS items.
• 6 CVEs have a public exploit or proof of concept recorded, which shortens the time from disclosure to attack.

About this data

Vendor attribution comes from the CNA and CPE product records of each CVE, folded to one vendor name; CVSS, EPSS and KEV status are read from the Threadlinqs CVE catalog; campaign and actor links come from tracked threat records. Counts reflect the data as of 2026-10-12 and refresh daily.