{"id":"CVE-2022-37042","kind":"vulnerability","aliases":["CVE-2022-37042"],"related":[],"title":"synacor zimbra collaboration suite: Zimbra Collaboration Suite (ZCS) 8.8.15 and 9.0 has mboximport functionality that receives a ZIP archive and…","description":"Zimbra Collaboration Suite (ZCS) 8.8.15 and 9.0 has mboximport functionality that receives a ZIP archive and extracts files from it. By bypassing authentication (i.e., not having an authtoken), an attacker can upload arbitrary files to the system, leading to directory traversal and remote code execution. NOTE: this issue exists because of an incomplete fix for CVE-2022-27925.","summary":"MailboxImportServlet (/service/extension/backup/mboximport) in ZCS 8.8.15 and 9.0 continues after a failed auth check (missing return), so unauthenticated users can reach the mboximport ZIP upload. Combined with CVE-2022-27925 path traversal this gives unauthenticated RCE via webshells. Mass-exploited since about June 2022 (1,000+ compromised servers per Volexity). Zimbra rates it High, CVSS 9.8.","severity":"critical","cvss":9.8,"epss":0.91893,"exploited":true,"exploited_at":"2022-08-11T00:00:00+00:00","products":[{"name":"Synacor Zimbra Collaboration Suite (ZCS)","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"Zimbra Collaboration Suite (ZCS)","fixed":["8.8.15 P33","9.0.0 P26"],"affected":"8.8.15 < P33; 9.0.0 < P26","ecosystem":"vendor"},{"name":"synacor zimbra collaboration suite","fixed":[],"affected":"= 8.8.15","ecosystem":"vendor"},{"name":"synacor zimbra collaboration suite","fixed":[],"affected":"= 9.0.0","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["exploited","mail-server","package","ransomware","rce","self-hosted","webshell","zimbra"],"not_affected_if":["managed-hosting","patched-8.8.15-p33","patched-9.0.0-p26"],"how_to_check":"Get the patch level as the zimbra user (zmcontrol -v); vulnerable if 8.8.15 below P33 or 9.0.0 below P26 (or any other release without these fixes). Search the web/nginx access logs for POST requests to /service/extension/backup/mboximport?account-name=...&ow=1&no-switch=true, often with a 401 response. Compromise check: compare the .jsp files under the Zimbra install with the default list for your version (Volexity) and look for unknown JSPs, which are webshells. Patching does not remove an existing compromise.","fix":"Upgrade to Zimbra 8.8.15 Patch 33 or 9.0.0 Patch 26 (released 2022-07-28) or any later release (9.0.0 P46, 10.0.x, 10.1.x). If the server was exposed before patching, hunt for webshells and rotate credentials. Stopgap: do not expose the admin and service ports to the internet.","status":"open","published_at":"2022-08-11T00:00:00+00:00","first_seen_at":"2026-10-23T19:11:52+00:00","triaged_at":"2026-10-23T21:11:01+00:00","updated_at":"2026-10-23T22:29:04+00:00","category":"package","confidence":0.9,"triage":{"at":"2026-10-23T21:11:01Z","model":"claude-haiku-5-5","output":{"fix":"Apply the Zimbra updates per vendor instructions (version numbers not stated in the sources).\nunknown","reach":"internet","impact":"high","summary":"Zimbra Collaboration Suite contains an authentication bypass in the MailboxImportServlet that lets an attacker skip login. Chained with CVE-2022-27925, it allows unauthenticated remote code execution on the mail server.","category":"package","who_cares":["zimbra","self-hosted","mail-server"],"confidence":0.7,"needs_auth":"no","worst_case":"Attacker runs code on the mail server without logging in","analyst_note":"Find the patched Zimbra versions and a detection method (MailboxImportServlet log lines or paths) at the CISA KEV entry or Synacor advisory.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["managed-hosting"],"user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"critical"},"cost_usd":0.000463,"input_tokens":2911,"output_tokens":343,"severity_before":"unknown"},"analyst_status":"done","analyst_note":"Find the patched Zimbra versions and a detection method (MailboxImportServlet log lines or paths) at the CISA KEV entry or Synacor advisory.","search":"'-2022':21A,24A,82B,167C '-27925':83B,168C '-37042':22A,25A '/service/extension/backup/mboximport':56B '000':100B '1':99B '2022':98B '8.8.15':9A,59B,115C '9.0':11A,61B,117C '9.8':110B 'arbitrari':143C 'archiv':19A,125C 'attack':140C 'auth':66B 'authent':133C 'authtoken':138C 'bypass':132C 'check':67B 'code':154C 'collabor':3A,6A,112C 'collaboration':28A,32A,37A,41A 'combin':79B 'compromis':101B 'continu':62B 'cve':20A,23A,81B,166C 'cvss':109B 'directori':150C 'execut':155C 'exist':159C 'exploit':43B,94B 'extract':127C 'fail':65B 'file':128C,144C 'fix':164C 'function':14A,120C 'give':87B 'high':108B 'host':52B 'i.e':134C 'incomplet':163C 'issu':158C 'june':97B 'lead':148C 'mail':45B 'mail-serv':44B 'mailboximportservlet':55B 'mass':93B 'mass-exploit':92B 'mboximport':13A,76B,119C 'miss':68B 'note':156C 'packag':47B 'path':84B 'per':103B 'ransomwar':48B 'rate':106B 'rce':49B,89B 'reach':74B 'receiv':16A,122C 'remot':153C 'return':69B 'self':51B 'self-host':50B 'server':46B,102B 'sinc':95B 'suit':4A,7A,113C 'suite':29A,33A,38A,42A 'synacor':1A,26A,35A,39A 'system':147C 'travers':85B,151C 'unauthent':71B,88B 'upload':78B,142C 'user':72B 'via':90B 'volex':104B 'webshel':53B,91B 'zcs':8A,30A,34A,58B,114C 'zimbra':2A,5A,27A,31A,36A,40A,54B,105B,111C 'zip':18A,77B,124C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2022-08-11T00:00:00+00:00","kev":{"dateAdded":"2022-08-11","dueDate":"2022-09-01","requiredAction":"Apply updates per vendor instructions.","knownRansomwareCampaignUse":"Known"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"nvd@nist.gov","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2022-37042","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2022-37042","severity":null,"published_at":"2022-08-11T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:52+00:00","fetched_at":"2026-10-25T20:35:35+00:00","note":null},{"source":"epss","external_id":"CVE-2022-37042","url":"https://api.first.org/data/v1/epss?cve=CVE-2022-37042","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:45+00:00","fetched_at":"2026-10-23T19:13:45+00:00","note":null},{"source":"analyst","external_id":"CVE-2022-37042:49","url":null,"severity":null,"published_at":"2026-10-23T21:16:57+00:00","modified_at":"2026-10-23T21:16:57+00:00","first_seen_at":"2026-10-23T21:16:57+00:00","fetched_at":"2026-10-23T21:16:57+00:00","note":"Zimbra blog + P33/P26 release notes name fixes; Volexity gives log pattern and webshell check; CISA confirms exploitation (KEV 2022-08-11). No public PoC link found; Volexity says write-ups exist."},{"source":"nvd","external_id":"CVE-2022-37042","url":"https://nvd.nist.gov/vuln/detail/CVE-2022-37042","severity":null,"published_at":"2022-08-12T15:15:16+00:00","modified_at":"2026-08-04T05:16:29+00:00","first_seen_at":"2026-10-23T22:29:04+00:00","fetched_at":"2026-10-23T22:29:04+00:00","note":null}],"documents":[{"id":923,"url":"https://blog.zimbra.com/2022/08/authentication-bypass-in-mailboximportservlet-vulnerability/","title":"Zimbra blog: Authentication Bypass in MailboxImportServlet","kind":"vendor","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":924,"url":"https://wiki.zimbra.com/wiki/Zimbra_Releases/8.8.15/P33","title":"Zimbra 8.8.15 P33 release notes","kind":"release","source":"analyst","text":null,"published_at":null,"relation":"fix","confidence":null,"note":null},{"id":925,"url":"https://wiki.zimbra.com/wiki/Zimbra_Releases/9.0.0/P26","title":"Zimbra 9.0.0 P26 release notes","kind":"release","source":"analyst","text":null,"published_at":null,"relation":"fix","confidence":null,"note":null},{"id":927,"url":"https://www.volexity.com/blog/2022/08/10/mass-exploitation-of-unauthenticated-zimbra-rce-cve-2022-27925/","title":"Volexity: Mass exploitation of Zimbra RCE","kind":"blog","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null},{"id":929,"url":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-228a","title":"CISA AA22-228A Zimbra exploitation","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}