Live › vulnerability › CVE-2022-37042
Go to dashboardMailboxImportServlet (/service/extension/backup/mboximport) in ZCS 8.8.15 and 9.0 continues after a failed auth check (missing return), so unauthenticated users can reach the mboximport ZIP upload. Combined with CVE-2022-27925 path traversal this gives unauthenticated RCE via webshells. Mass-exploited since about June 2022 (1,000+ compromised servers per Volexity). Zimbra rates it High, CVSS 9.8.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:11 UTC, 3h before NVD. All times on this page are UTC.
Apply updates per vendor instructions.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| Synacor Zimbra Collaboration Suite (ZCS) | vendor | – | – |
| Zimbra Collaboration Suite (ZCS) | vendor | 8.8.15 < P33; 9.0.0 < P26 | 8.8.15 P33, 9.0.0 P26 |
| synacor zimbra collaboration suite | vendor | = 8.8.15 | – |
| synacor zimbra collaboration suite | vendor | = 9.0.0 | – |
8.8.15 below P33 or 9.0.0 below P26 (or any other release without these fixes)8.8.15 Patch 33 or 9.0.0 Patch 26 (released 2022-07-28) or any later release (9.0.0 P46, 10.0.x, 10.1.x)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Zimbra Collaboration Suite (ZCS) 8.8.15 and 9.0 has mboximport functionality that receives a ZIP archive and extracts files from it. By bypassing authentication (i.e., not having an authtoken), an attacker can upload arbitrary files to the system, leading to directory traversal and remote code execution. NOTE: this issue exists because of an incomplete fix for CVE-2022-27925.
This page as .md · .json · in your agent: get_signal("CVE-2022-37042")
CISA KEV catalog, Creative Commons 0 · EPSS scores by FIRST, used with attribution · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.