---
id: "CVE-2022-37042"
kind: "vulnerability"
aliases: ["CVE-2022-37042"]
title: "synacor zimbra collaboration suite: Zimbra Collaboration Suite (ZCS) 8.8.15 and 9.0 has mboximport functionality that receives a ZIP archive and\u2026"
severity: "critical"
cvss: 9.8
epss: 0.91893
exploited: true
status: "open"
category: "package"
products: [{"name": "Synacor Zimbra Collaboration Suite (ZCS)", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "Zimbra Collaboration Suite (ZCS)", "fixed": ["8.8.15 P33", "9.0.0 P26"], "affected": "8.8.15 < P33; 9.0.0 < P26", "ecosystem": "vendor"}, {"name": "synacor zimbra collaboration suite", "fixed": [], "affected": "= 8.8.15", "ecosystem": "vendor"}, {"name": "synacor zimbra collaboration suite", "fixed": [], "affected": "= 9.0.0", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["exploited", "mail-server", "package", "ransomware", "rce", "self-hosted", "webshell", "zimbra"]
not_affected_if: ["managed-hosting", "patched-8.8.15-p33", "patched-9.0.0-p26"]
published_at: "2022-08-11T00:00:00+00:00"
first_seen_at: "2026-10-23T19:11:52+00:00"
updated_at: "2026-10-23T22:29:04+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2022-37042", "first_seen_at": "2026-10-23T19:11:52+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2022-37042", "first_seen_at": "2026-10-23T19:13:45+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T21:16:57+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-37042", "first_seen_at": "2026-10-23T22:29:04+00:00"}]
---

# synacor zimbra collaboration suite: Zimbra Collaboration Suite (ZCS) 8.8.15 and 9.0 has mboximport functionality that receives a ZIP archive and…

MailboxImportServlet (/service/extension/backup/mboximport) in ZCS 8.8.15 and 9.0 continues after a failed auth check (missing return), so unauthenticated users can reach the mboximport ZIP upload. Combined with CVE-2022-27925 path traversal this gives unauthenticated RCE via webshells. Mass-exploited since about June 2022 (1,000+ compromised servers per Volexity). Zimbra rates it High, CVSS 9.8.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Synacor Zimbra Collaboration Suite (ZCS) affected ? fixed ?
- vendor:Zimbra Collaboration Suite (ZCS) affected 8.8.15 < P33; 9.0.0 < P26 fixed 8.8.15 P33, 9.0.0 P26
- vendor:synacor zimbra collaboration suite affected = 8.8.15 fixed ?
- vendor:synacor zimbra collaboration suite affected = 9.0.0 fixed ?

## How to check

Get the patch level as the zimbra user (zmcontrol -v); vulnerable if 8.8.15 below P33 or 9.0.0 below P26 (or any other release without these fixes). Search the web/nginx access logs for POST requests to /service/extension/backup/mboximport?account-name=...&ow=1&no-switch=true, often with a 401 response. Compromise check: compare the .jsp files under the Zimbra install with the default list for your version (Volexity) and look for unknown JSPs, which are webshells. Patching does not remove an existing compromise.

## Fix

Upgrade to Zimbra 8.8.15 Patch 33 or 9.0.0 Patch 26 (released 2022-07-28) or any later release (9.0.0 P46, 10.0.x, 10.1.x). If the server was exposed before patching, hunt for webshells and rotate credentials. Stopgap: do not expose the admin and service ports to the internet.

## Timeline

- 2026-10-23T19:11:52+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2022-37042
- 2026-10-23T19:13:45+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2022-37042
- 2026-10-23T21:16:57+00:00 analyst — Zimbra blog + P33/P26 release notes name fixes; Volexity gives log pattern and webshell check; CISA confirms exploitation (KEV 2022-08-11). No public PoC link found; Volexity says write-ups exist.
- 2026-10-23T22:29:04+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2022-37042

## Documents

- [advisory] Zimbra blog: Authentication Bypass in MailboxImportServlet https://blog.zimbra.com/2022/08/authentication-bypass-in-mailboximportservlet-vulnerability/
- [describes] Volexity: Mass exploitation of Zimbra RCE https://www.volexity.com/blog/2022/08/10/mass-exploitation-of-unauthenticated-zimbra-rce-cve-2022-27925/
- [describes] CISA AA22-228A Zimbra exploitation https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-228a
- [fix] Zimbra 8.8.15 P33 release notes https://wiki.zimbra.com/wiki/Zimbra_Releases/8.8.15/P33
- [fix] Zimbra 9.0.0 P26 release notes https://wiki.zimbra.com/wiki/Zimbra_Releases/9.0.0/P26

## From the sources

Zimbra Collaboration Suite (ZCS) 8.8.15 and 9.0 has mboximport functionality that receives a ZIP archive and extracts files from it. By bypassing authentication (i.e., not having an authtoken), an attacker can upload arbitrary files to the system, leading to directory traversal and remote code execution. NOTE: this issue exists because of an incomplete fix for CVE-2022-27925.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_