CVE-2022-27924
Synacor Zimbra Collaboration Suite (ZCS): Command Injection
As of , CVE-2022-27924 in Synacor Zimbra Collaboration Suite (ZCS) is on CISA's list of exploited vulnerabilities: CISA listed it on . Our patch-first group: Patch this week.
- Exploited
- Yes: CISA listed it on 4 August 2022
- US federal deadline
- 25 August 202221 days after CISA listed it. US federal civilian agencies must fix it by then.
- Used in ransomware campaigns
- KnownCISA changed it from Unknown to Known on 9 June 2025.
- EPSS score
- 0.94Higher than 99% of the CVEs EPSS scores. EPSS estimates the chance of exploitation activity in the next 30 days.
- EPSS when listed
- 0.01 on 4 August 2022EPSS on the day CISA listed it.
- Public exploit
- None foundNeither Metasploit nor Exploit-DB lists one.
- Fix
- Vendor advice: wiki.zimbra.comLinks below, from CISA's entry.
What CISA says to do
Apply updates per vendor instructions.
CISA's required action
What the flaw is
Synacor Zimbra Collaboration Suite (ZCS) allows an attacker to inject memcache commands into a targeted instance which causes an overwrite of arbitrary cached entries.
CISA's description
Zimbra Collaboration (aka ZCS) 8.8.15 and 9.0 allows an unauthenticated attacker to inject arbitrary memcache commands into a targeted instance. These memcache commands becomes unescaped, causing an overwrite of arbitrary cached entries.
The CVE record's description, from mitre
- CVE published
- 20 April 2022
- Assigned by
- mitre
- CVSS
- 9.8 Critical (CVSS 3.1, from CISA-ADP)
- CWE-74
- Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
- CWE-93
- Improper Neutralization of CRLF Sequences ('CRLF Injection')
- CISA SSVC, exploitation
- active
- CISA SSVC, automatable
- yes
- CISA SSVC, technical impact
- total
Timeline
- The CVE record was published.
- CISA added it to its list of exploited vulnerabilities.
- The US federal deadline to fix it.
- CISA changed its entry. Renamed from Zimbra Collaboration (ZCS) to Synacor Zimbra Collaboration Suite (ZCS). Edited: description and name.
- CISA changed its entry. Ransomware use: Unknown to Known.
Zimbra Collaboration Suite (ZCS): other exploited entries
| Vulnerability | Product | Our group | Listed | Deadline | EPSS |
|---|---|---|---|---|---|
| CVE-2026-73570OS Command Injection | Synacor Zimbra Collaboration Suite (ZCS) | Patch nowForensic triage required by CISA | 0.72 | ||
| CVE-2019-9621Server-Side Request Forgery (SSRF) | Synacor Zimbra Collaboration Suite (ZCS) | Patch this weekMetasploit module; EPSS 0.81; verified Exploit-DB entry | 0.81 | ||
| CVE-2019-9670Improper Restriction of XML External Entity Reference | Synacor Zimbra Collaboration Suite (ZCS) | Patch this weekMetasploit module; EPSS 0.99; verified Exploit-DB entry | 0.99 | ||
| CVE-2022-41352Arbitrary File Upload | Synacor Zimbra Collaboration Suite (ZCS) | Patch this weekRansomware use; Metasploit module; EPSS 0.95 | 0.95 | ||
| CVE-2022-27925Arbitrary File Upload | Synacor Zimbra Collaboration Suite (ZCS) | Patch this weekRansomware use; Metasploit module; EPSS 0.99 | 0.99 | ||
| CVE-2022-37042Authentication Bypass | Synacor Zimbra Collaboration Suite (ZCS) | Patch this weekRansomware use; Metasploit module; EPSS 0.92 | 0.92 | ||
| CVE-2023-34192Cross-Site Scripting (XSS) | Synacor Zimbra Collaboration Suite (ZCS) | Patch this weekEPSS 0.77 | 0.77 | ||
| CVE-2024-45519Command Execution | Synacor Zimbra Collaboration Suite (ZCS) | Patch this weekEPSS 0.99 | 0.99 | ||
| CVE-2018-6882Cross-Site Scripting (XSS) | Synacor Zimbra Collaboration Suite (ZCS) | Patch this weekRansomware use | 0.30 | ||
| CVE-2025-68645PHP Remote File Inclusion | Synacor Zimbra Collaboration Suite (ZCS) | Patch soon | 0.49 |
Read further
- CVE recordcve.org
- NVD entrynvd.nist.gov
- CISA's catalogcisa.gov
- EPSS for this CVEapi.first.org