{"id":"CVE-2022-27925","kind":"vulnerability","aliases":["CVE-2022-27925"],"related":[],"title":"synacor zimbra collaboration suite: Zimbra Collaboration (aka ZCS) 8.8.15 and 9.0 has mboximport functionality that receives a ZIP archive and extracts…","description":"Synacor Zimbra Collaboration Suite (ZCS) contains flaw in the mboximport functionality, allowing an authenticated attacker to upload arbitrary files to perform remote code execution. This vulnerability was chained with CVE-2022-37042 which allows for unauthenticated remote code execution.\n\nCISA required action: Apply updates per vendor instructions.","summary":"ZCS 8.8.15 and 9.0 mboximport (/service/extension/backup/mboximport) extracts uploaded ZIPs with directory traversal, so an administrator can write arbitrary files (webshells) and get code execution (NVD CVSS 7.2). On its own it needs admin rights. CVE-2022-37042, an auth bypass on the same endpoint, removes that requirement: the pair is unauthenticated RCE, mass-exploited since about June 2022 (Volexity) and used in ransomware. CISA KEV added 2022-08-11.","severity":"critical","cvss":7.2,"epss":0.98676,"exploited":true,"exploited_at":"2022-08-11T00:00:00+00:00","products":[{"name":"Synacor Zimbra Collaboration Suite (ZCS)","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"Zimbra Collaboration Suite (ZCS)","fixed":["8.8.15 P33","9.0.0 P26"],"affected":"8.8.15 < P33; 9.0.0 < P26 (admin-only flaw: < P31 / < P24)","ecosystem":"vendor"},{"name":"synacor zimbra collaboration suite","fixed":[],"affected":"= 8.8.15","ecosystem":"vendor"},{"name":"synacor zimbra collaboration suite","fixed":[],"affected":"= 9.0.0","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["chained","exploited","mail-server","ransomware","rce","self-hosted","vendor","webshell","zimbra"],"not_affected_if":["managed-hosting","patched-8.8.15-p33","patched-9.0.0-p26"],"how_to_check":"As the zimbra user run zmcontrol -v. Exposed if patch level is below 8.8.15 P33 or 9.0.0 P26 (below P31/P24 is exposed to the admin-only flaw; below P33/P26 to the unauthenticated chain). Search web/nginx logs for POST /service/extension/backup/mboximport. Look for unknown .jsp files under the Zimbra install (webshells); patching does not remove an existing compromise.","fix":"Upgrade to 8.8.15 Patch 33 or 9.0.0 Patch 26 (2022-07-28) or later; these fix both CVE-2022-27925 (first fixed in P31/P24) and CVE-2022-37042. If exposed before patching, hunt for webshells and rotate credentials. Stopgap: do not expose admin/service ports to the internet.","status":"open","published_at":"2022-04-21T00:15:08+00:00","first_seen_at":"2026-10-23T19:11:52+00:00","triaged_at":"2026-10-23T21:11:00+00:00","updated_at":"2026-10-23T22:29:04+00:00","category":"vendor","confidence":0.85,"triage":{"at":"2026-10-23T21:11:00Z","model":"claude-haiku-5-5","output":{"fix":"Apply the vendor updates for Zimbra Collaboration Suite as CISA requires; the specific fixed version is unknown from the sources.\nUnknown whether the mboximport flaw is patched separately from CVE-2022-37042.","reach":"internet","impact":"high","summary":"Zimbra Collaboration Suite has an arbitrary file upload flaw in its mboximport functionality. An authenticated attacker can upload files and run code on the server, and it was chained with CVE-2022-37042 for unauthenticated code execution.","category":"vendor","who_cares":["zimbra","self-hosted","mail-server"],"confidence":0.8,"needs_auth":"yes","worst_case":"Attacker runs code on the mail server after logging in.","analyst_note":"Find the vendor advisory and the fixed Zimbra versions, plus whether CVE-2022-37042 is required for unauthenticated exploitation, via the CISA KEV entry and the Zimbra security advisories.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["managed-hosting"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.0005,"input_tokens":2932,"output_tokens":414,"severity_before":"unknown"},"analyst_status":"done","analyst_note":"Find the vendor advisory and the fixed Zimbra versions, plus whether CVE-2022-37042 is required for unauthenticated exploitation, via the CISA KEV entry and the Zimbra security advisories.","search":"'-08':126B '-11':127B '-2022':23A,26A,93B,158C '-27925':24A,27A '-37042':94B,159C '/service/extension/backup/mboximport':63B '2022':116B,125B '7.2':84B '8.8.15':9A,59B '9.0':11A,61B 'action':169C 'add':124B 'admin':90B 'administr':72B 'aka':7A 'allow':139C,161C 'appli':170C 'arbitrari':75B,145C 'archiv':19A 'attack':142C 'auth':96B 'authent':141C 'bypass':97B 'chain':45B,155C 'cisa':122B,167C 'code':80B,150C,165C 'collabor':3A,6A,130C 'collaboration':30A,34A,39A,43A 'contain':133C 'cve':22A,25A,92B,157C 'cvss':83B 'directori':68B 'endpoint':101B 'execut':81B,151C,166C 'exploit':46B,112B 'extract':21A,64B 'file':76B,146C 'flaw':134C 'function':14A,138C 'get':79B 'host':54B 'instruct':174C 'june':115B 'kev':123B 'mail':48B 'mail-serv':47B 'mass':111B 'mass-exploit':110B 'mboximport':13A,62B,137C 'need':89B 'nvd':82B 'pair':106B 'per':172C 'perform':148C 'ransomwar':50B,121B 'rce':51B,109B 'receiv':16A 'remot':149C,164C 'remov':102B 'requir':104B,168C 'right':91B 'self':53B 'self-host':52B 'server':49B 'sinc':113B 'suit':4A,131C 'suite':31A,35A,40A,44A 'synacor':1A,28A,37A,41A,128C 'travers':69B 'unauthent':108B,163C 'updat':171C 'upload':65B,144C 'use':119B 'vendor':55B,173C 'volex':117B 'vulner':153C 'webshel':56B,77B 'write':74B 'zcs':8A,32A,36A,58B,132C 'zimbra':2A,5A,29A,33A,38A,42A,57B,129C 'zip':18A,66B","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2022-04-21T00:15:08+00:00","kev":{"dateAdded":"2022-08-11","dueDate":"2022-09-01","requiredAction":"Apply updates per vendor instructions.","knownRansomwareCampaignUse":"Known"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","cvss_by":"nvd@nist.gov","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2022-27925","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2022-27925","severity":null,"published_at":"2022-08-11T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:52+00:00","fetched_at":"2026-10-25T17:39:57+00:00","note":null},{"source":"epss","external_id":"CVE-2022-27925","url":"https://api.first.org/data/v1/epss?cve=CVE-2022-27925","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:45+00:00","fetched_at":"2026-10-23T19:13:45+00:00","note":null},{"source":"analyst","external_id":"CVE-2022-27925:51","url":null,"severity":null,"published_at":"2026-10-23T21:17:51+00:00","modified_at":"2026-10-23T21:17:51+00:00","first_seen_at":"2026-10-23T21:17:51+00:00","fetched_at":"2026-10-23T21:17:51+00:00","note":"Zimbra blog + P26 notes + Volexity + CISA AA22-228A + NVD read. Original flaw fixed 8.8.15 P31/9.0.0 P24 (Mar 2022, per Volexity); NOT alone unauthenticated: needs admin auth, but CVE-2022-37042 (fixed P33/P26) bypasses auth so the chain is unauth RCE. Zimbra advisory page does not list P31/P24 directly; no public PoC link found."},{"source":"nvd","external_id":"CVE-2022-27925","url":"https://nvd.nist.gov/vuln/detail/CVE-2022-27925","severity":null,"published_at":"2022-04-21T00:15:08+00:00","modified_at":"2026-10-01T19:17:14+00:00","first_seen_at":"2026-10-23T22:29:04+00:00","fetched_at":"2026-10-23T22:29:04+00:00","note":null}],"documents":[{"id":923,"url":"https://blog.zimbra.com/2022/08/authentication-bypass-in-mailboximportservlet-vulnerability/","title":"Zimbra blog: Authentication Bypass in MailboxImportServlet","kind":"vendor","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":927,"url":"https://www.volexity.com/blog/2022/08/10/mass-exploitation-of-unauthenticated-zimbra-rce-cve-2022-27925/","title":"Volexity: Mass exploitation of Zimbra RCE","kind":"blog","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null},{"id":925,"url":"https://wiki.zimbra.com/wiki/Zimbra_Releases/9.0.0/P26","title":"Zimbra 9.0.0 P26 release notes","kind":"release","source":"analyst","text":null,"published_at":null,"relation":"fix","confidence":null,"note":null},{"id":929,"url":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-228a","title":"CISA AA22-228A Zimbra exploitation","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null},{"id":938,"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-27925","title":"NVD CVE-2022-27925","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}