# Synacor vulnerabilities & exploitation **CISA KEV** · **Ransomware** > As of 2026-10-12, Threadlinqs tracks 7 Synacor CVEs, 7 in the CISA Known Exploited Vulnerabilities catalog, 3 used in ransomware campaigns, linked to 9 tracked threat campaigns and 3 named threat actors. **Data as of:** 2026-10-12 ## Exploitation timeline Threadlinqs has recorded 7 Synacor CVEs published between 2022-04-15 and 2026-01-15. The busiest month was 2023-07 (1 new CVE). 7 of them (100%) are listed in CISA KEV, which means exploitation in the wild has been confirmed. ## Most exploited vulnerabilities Ranked with CISA KEV listings first, then EPSS exploit probability, then CVSS score. Showing 7 of 7 tracked Synacor CVEs. - [CVE-2024-45519](https://intel.threadlinqs.com/cve/CVE-2024-45519) — CRITICAL 10 · KEV · EPSS 99.9% · 2024-10-02 - [CVE-2022-27925](https://intel.threadlinqs.com/cve/CVE-2022-27925) — HIGH 7.2 · KEV · Ransomware · EPSS 98.2% · 2022-04-20 - [CVE-2022-41352](https://intel.threadlinqs.com/cve/CVE-2022-41352) — CRITICAL 9.8 · KEV · Ransomware · EPSS 95.5% · 2022-09-26 - [CVE-2022-37042](https://intel.threadlinqs.com/cve/CVE-2022-37042) — CRITICAL 9.8 · KEV · Ransomware · EPSS 91.9% · 2022-08-11 - [CVE-2023-37580](https://intel.threadlinqs.com/cve/CVE-2023-37580) — MEDIUM 6.1 · KEV · EPSS 49.1% · 2023-07-31 - [CVE-2025-66376](https://intel.threadlinqs.com/cve/CVE-2025-66376) — HIGH 7.2 · KEV · EPSS 20.2% · 2026-01-05 - [CVE-2025-27915](https://intel.threadlinqs.com/cve/CVE-2025-27915) — MEDIUM 5.4 · KEV · EPSS 4% · 2025-03-12 ## Products affected Threadlinqs normalises CPE and CNA product records across all 7 CVEs; 1 distinct Synacor product is affected. The most frequently affected: - Zimbra Collaboration Suite — 7 CVEs ## Threat activity 9 tracked threat campaigns reference Synacor products or exploit Synacor CVEs: - [Chinese-speaking threat group UAT-10147 uses agentic AI to automate exploitation of internet-facing web servers](https://intel.threadlinqs.com/threat/TL-2026-2096) — HIGH — 2026-08-21 - [Russian TA488 (Void Blizzard / Laundry Bear) Exploits Exchange OWA Zero-Day (CVE-2026-42897) with OWAReaper Backdoor for Long-Term Mailbox Access](https://intel.threadlinqs.com/threat/TL-2026-1763) — CRITICAL — 2026-07-29 - [Operation RoundPress: TA458 Deploys SpyPress Malware via Half-Click Webmail Zero-Days (CVE-2025-27915, CVE-2025-3929, CVE-2026-8496)](https://intel.threadlinqs.com/threat/TL-2026-2579) — CRITICAL — 2026-07-23 - [Zimbra Collaboration Suite 10.1.20 Patches Critical Unauthenticated SNMP/Swatchdog Command Injection Plus Six Additional CVEs](https://intel.threadlinqs.com/threat/TL-2026-1586) — CRITICAL — 2026-07-21 - [StrikeShark Campaign: SharkLoader Dropper Targets Governments and Software Developers via N-Day Exploits and Trojanized Installers to Deploy Cobalt Strike](https://intel.threadlinqs.com/threat/TL-2026-1237) — HIGH — 2026-07-11 - [Zimbra Collaboration Suite Critical Stored XSS in Classic Web Client (Patched in ZCS 10.1.19)](https://intel.threadlinqs.com/threat/TL-2026-1176) — CRITICAL — 2026-07-10 - [SharkLoader Malware Campaign Uses Fake Cisco AnyConnect and Google Update Installers to Deploy Cobalt Strike](https://intel.threadlinqs.com/threat/TL-2026-1101) — HIGH — 2026-07-03 - [SharkLoader Malware Deploys Cobalt Strike Beacon via DLL Side-Loading in StrikeShark Campaign](https://intel.threadlinqs.com/threat/TL-2026-0961) — HIGH — 2026-06-27 - [Zimbra Collaboration Suite Stored XSS via CSS @import Active Exploitation (CVE-2025-66376) — Operation GhostMail](https://intel.threadlinqs.com/threat/TL-2026-0266) — CRITICAL — 2026-03-21 ## Threat actors targeting Synacor Named threat actors attributed to campaigns that involve Synacor products or CVEs, with the number of linked campaigns: - [StrikeShark](https://intel.threadlinqs.com/actor/StrikeShark) — 2 campaigns - [APT28](https://intel.threadlinqs.com/actor/APT28) — 1 campaign - [Void Blizzard](https://intel.threadlinqs.com/actor/Void%20Blizzard) — 1 campaign ## How to prioritise Synacor patching This order follows the data Threadlinqs holds for Synacor, not a generic severity checklist: - 7 of 7 Synacor CVEs (100%) are in CISA KEV: treat them as actively exploited and remediate them first, starting with [CVE-2024-45519](https://intel.threadlinqs.com/cve/CVE-2024-45519), [CVE-2022-27925](https://intel.threadlinqs.com/cve/CVE-2022-27925), [CVE-2022-41352](https://intel.threadlinqs.com/cve/CVE-2022-41352). - 3 CVEs are known to be used in ransomware campaigns; patch these ahead of other KEV entries on internet-facing systems. - 3 CVEs score Critical and 2 High on CVSS v3 (maximum 10, average 7.9); sequence these after KEV and high-EPSS items. - 6 CVEs have a public exploit or proof of concept recorded, which shortens the time from disclosure to attack. ## About this data Vendor attribution comes from the CNA and CPE product records of each CVE, folded to one vendor name; CVSS, EPSS and KEV status are read from the Threadlinqs CVE catalog; campaign and actor links come from tracked threat records. Counts reflect the data as of 2026-10-12 and refresh daily. Canonical: https://intel.threadlinqs.com/vendors/synacor All vendors: https://intel.threadlinqs.com/vendors Full detection coverage and IOCs via the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp