--- id: "CVE-2022-27925" kind: "vulnerability" aliases: ["CVE-2022-27925"] title: "synacor zimbra collaboration suite: Zimbra Collaboration (aka ZCS) 8.8.15 and 9.0 has mboximport functionality that receives a ZIP archive and extracts\u2026" severity: "critical" cvss: 7.2 epss: 0.98676 exploited: true status: "open" category: "vendor" products: [{"name": "Synacor Zimbra Collaboration Suite (ZCS)", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "Zimbra Collaboration Suite (ZCS)", "fixed": ["8.8.15 P33", "9.0.0 P26"], "affected": "8.8.15 < P33; 9.0.0 < P26 (admin-only flaw: < P31 / < P24)", "ecosystem": "vendor"}, {"name": "synacor zimbra collaboration suite", "fixed": [], "affected": "= 8.8.15", "ecosystem": "vendor"}, {"name": "synacor zimbra collaboration suite", "fixed": [], "affected": "= 9.0.0", "ecosystem": "vendor"}] ecosystems: ["vendor"] tags: ["chained", "exploited", "mail-server", "ransomware", "rce", "self-hosted", "vendor", "webshell", "zimbra"] not_affected_if: ["managed-hosting", "patched-8.8.15-p33", "patched-9.0.0-p26"] published_at: "2022-04-21T00:15:08+00:00" first_seen_at: "2026-10-23T19:11:52+00:00" updated_at: "2026-10-23T22:29:04+00:00" sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2022-27925", "first_seen_at": "2026-10-23T19:11:52+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2022-27925", "first_seen_at": "2026-10-23T19:13:45+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T21:17:51+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-27925", "first_seen_at": "2026-10-23T22:29:04+00:00"}] --- # synacor zimbra collaboration suite: Zimbra Collaboration (aka ZCS) 8.8.15 and 9.0 has mboximport functionality that receives a ZIP archive and extracts… ZCS 8.8.15 and 9.0 mboximport (/service/extension/backup/mboximport) extracts uploaded ZIPs with directory traversal, so an administrator can write arbitrary files (webshells) and get code execution (NVD CVSS 7.2). On its own it needs admin rights. CVE-2022-37042, an auth bypass on the same endpoint, removes that requirement: the pair is unauthenticated RCE, mass-exploited since about June 2022 (Volexity) and used in ransomware. CISA KEV added 2022-08-11. _Summary, check and fix written by a model from the sources; labelled as such._ ## Affected - vendor:Synacor Zimbra Collaboration Suite (ZCS) affected ? fixed ? - vendor:Zimbra Collaboration Suite (ZCS) affected 8.8.15 < P33; 9.0.0 < P26 (admin-only flaw: < P31 / < P24) fixed 8.8.15 P33, 9.0.0 P26 - vendor:synacor zimbra collaboration suite affected = 8.8.15 fixed ? - vendor:synacor zimbra collaboration suite affected = 9.0.0 fixed ? ## How to check As the zimbra user run zmcontrol -v. Exposed if patch level is below 8.8.15 P33 or 9.0.0 P26 (below P31/P24 is exposed to the admin-only flaw; below P33/P26 to the unauthenticated chain). Search web/nginx logs for POST /service/extension/backup/mboximport. Look for unknown .jsp files under the Zimbra install (webshells); patching does not remove an existing compromise. ## Fix Upgrade to 8.8.15 Patch 33 or 9.0.0 Patch 26 (2022-07-28) or later; these fix both CVE-2022-27925 (first fixed in P31/P24) and CVE-2022-37042. If exposed before patching, hunt for webshells and rotate credentials. Stopgap: do not expose admin/service ports to the internet. ## Timeline - 2026-10-23T19:11:52+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2022-27925 - 2026-10-23T19:13:45+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2022-27925 - 2026-10-23T21:17:51+00:00 analyst — Zimbra blog + P26 notes + Volexity + CISA AA22-228A + NVD read. Original flaw fixed 8.8.15 P31/9.0.0 P24 (Mar 2022, per Volexity); NOT alone unauthenticated: needs admin auth, but CVE-2022-37042 (fixed P33/P26) bypasses auth so the chain is unauth RCE. Zimbra advisory page does not list P31/P24 directly; no public PoC link found. - 2026-10-23T22:29:04+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2022-27925 ## Documents - [advisory] Zimbra blog: Authentication Bypass in MailboxImportServlet https://blog.zimbra.com/2022/08/authentication-bypass-in-mailboximportservlet-vulnerability/ - [describes] Volexity: Mass exploitation of Zimbra RCE https://www.volexity.com/blog/2022/08/10/mass-exploitation-of-unauthenticated-zimbra-rce-cve-2022-27925/ - [describes] CISA AA22-228A Zimbra exploitation https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-228a - [fix] Zimbra 9.0.0 P26 release notes https://wiki.zimbra.com/wiki/Zimbra_Releases/9.0.0/P26 - [mentions] NVD CVE-2022-27925 https://nvd.nist.gov/vuln/detail/CVE-2022-27925 ## From the sources Synacor Zimbra Collaboration Suite (ZCS) contains flaw in the mboximport functionality, allowing an authenticated attacker to upload arbitrary files to perform remote code execution. This vulnerability was chained with CVE-2022-37042 which allows for unauthenticated remote code execution. CISA required action: Apply updates per vendor instructions. --- _Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_