CVE-2022-27924

KEVRansomware UseSynacor Zimbra Collaboration Suite (ZCS) Command Injection Vulnerability

Description

Synacor Zimbra Collaboration Suite (ZCS) allows an attacker to inject memcache commands into a targeted instance which causes an overwrite of arbitrary cached entries.

Zimbra Collaboration (aka ZCS) 8.8.15 and 9.0 allows an unauthenticated attacker to inject arbitrary memcache commands into a targeted instance. These memcache commands becomes unescaped, causing an overwrite of arbitrary cached entries.

CVSS 3.1 vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

PublishedApr 21, 2022

Last modifiedOct 2, 2026

Added to KEVAug 4, 2022

Remediation dueAug 25, 2022

References

wiki.zimbra.com/wiki/Security_CenterVendor Advisory
wiki.zimbra.com/wiki/Zimbra_Releases/9.0.0/P24Release NotesVendor Advisory
wiki.zimbra.com/wiki/Zimbra_Security_AdvisoriesVendor Advisory
cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-27924US Government Resource

0 recent articles mention this CVE

Risk assessment · Critical

Actively exploited and used by ransomware crews. Patch immediately.

Exploitation: Confirmed in the wild (CISA KEV)
Federal remediation deadline: Overdue by 1523 days
Ransomware: Used in known ransomware campaigns
CVSS: 7.5 HIGH
EPSS (30-day exploit probability): 93.9% · top 1% of all CVEs
Weakness: CWE-74
Attack vector: Network, remotely reachable
Preconditions: No privileges and no user interaction

Recommended actions

1.Apply updates per vendor instructions.
2.Treat as emergency change: patch or isolate internet-facing instances first.
3.Review exposure: confirm which instances are reachable from the internet and restrict access until patched.
4.Hunt for compromise: review logs for the disclosure window, not just from the patch date.
5.Verify offline/immutable backups and segment the affected systems. This flaw is used for ransomware initial access.

Assessment is derived automatically from the live signals above; verify against your own asset inventory.