CVE-2022-27924 Synacor Zimbra Collaboration Suite (ZCS) Command Injection

Exploited in the wild Critical 9.8 Published 20 Apr 2022 Updated 1 Oct 2026

Unauthenticated attackers can inject memcache commands to overwrite cached entries in Zimbra Collaboration.

Exploited in the wild: Since 4 Aug 2022
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2022-27924?

CVE-2022-27924 is a critical vulnerability in Synacor Zimbra Collaboration Suite, published on 20 Apr 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Zimbra Collaboration (aka ZCS) 8.8.15 and 9.0 allows an unauthenticated attacker to inject arbitrary memcache commands into a targeted instance. These memcache commands becomes unescaped, causing an overwrite of arbitrary cached entries.

Weakness: CWE-74

Which versions are affected by CVE-2022-27924?

It affects 1 product.

Products include Synacor Zimbra Collaboration Suite.

How do I fix CVE-2022-27924?

No fix has been published for CVE-2022-27924 yet. Limit exposure of the affected software until one is available. US federal agencies must fix it by 25 Aug 2022.

Is CVE-2022-27924 being exploited?

Yes. Attackers have exploited CVE-2022-27924 in the wild since at least 4 Aug 2022, including in ransomware campaigns.

Public exploit code: 1 Nuclei template.

All Synacor Zimbra Collaboration Suite vulnerabilities

Sources

Also known as GHSA-763p-5rx7-r4qf.