CVE-2022-27924

Zimbra Collaboration (aka ZCS) 8.8.15 and 9.0 allows an unauthenticated attacker to inject arbitrary memcache commands into a targeted instance. These memcache commands becomes unescaped, causing an overwrite of arbitrary cached entries.

CVSS 3.1

7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

EPSS

94% chance of exploitation in the next 30 days; higher than 99% of CVEs (scores of 2026-10-25)

CISA KEV

listed 2022-08-04, due 2022-08-25, known ransomware use

CWE

CWE-74

Published

2022-04-21

Modified

2026-10-02

Record from

the NVD, synced 2026-10-19

Affected

• synacor:zimbra_collaboration_suite

References

• https://wiki.zimbra.com/wiki/Security_Center
• https://wiki.zimbra.com/wiki/Zimbra_Releases/9.0.0/P24
• https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories
• https://wiki.zimbra.com/wiki/Security_Center
• https://wiki.zimbra.com/wiki/Zimbra_Releases/9.0.0/P24

Check your stackJSON