CVE-2022-27924

Exploited in the wild. In CISA KEV since 2022‑08‑04. A vendor fix is available.

CVSS 3.17.5High EPSS percentile99th94% chance in 30 days CISA KEVListedsince 2022-08-04, due 2022-08-25
No public exploit known FixVendor fixNo build named by the sources

Published 2022-04-20Updated 2026-10-02Sources: CVE.org, NVD, BDU

NVD CVE.org

What to do

The vendor has published a fix. Version details are below where the sources state them.

Zimbra Inc. Zimbra Collaboration SuiteAffected: до 9.0.0 P24Upgrade to: not statedStated by: BDU

Versions as the sources state them. Full version matrix after sign-in

Steps

Written by AI from the record

Check if you run Zimbra Collaboration Suite version 8.8.15 or 9.0 — ask your IT provider or email administrator if unsure.
If affected, apply the vendor patch immediately (version 9.0.0 Patch 24 or later) via the official Zimbra release notes.
If you cannot patch right away, take the mail server offline or restrict network access to it until patched.
After patching, review server logs for signs of prior compromise, since this flaw has already been used in attacks.
Confirm with your IT provider that the patch was actually applied and the server was checked for intrusion.

Vendor advisory Some work to apply

Check it yourselfA free Nuclei and OpenVAS check exists for this CVE. Run it against your hosts.Is your organisation exposed?Discuss checks for your systems with a specialist. Scope is agreed before testing.

Coverage timeline

0 publishers

Added to CISA KEV catalog
Aug 4, 2022·CISA KEV

Sourced from public security reporting — each date is when it was published, not when it happened.

What it is

From the CVE record

Zimbra Collaboration (aka ZCS) 8.8.15 and 9.0 allows an unauthenticated attacker to inject arbitrary memcache commands into a targeted instance. These memcache commands becomes unescaped, causing an overwrite of arbitrary cached entries.

In plain language

Written by AI from the record

If you run Zimbra email servers, attackers are actively breaking into unpatched systems right now to launch ransomware, so this needs urgent action, not a routine update later.

Unauthenticated memcache command injection (CWE-74) in Zimbra Collaboration Suite 8.8.15 and 9.0 lets a remote attacker overwrite arbitrary cached entries over the network with no authentication, and it has been actively exploited in ransomware campaigns.

If you're affected

Email system compromise
Ransomware deployment
Operational disruption to mail service
Potential customer/business data exposure

What is it

Think of memcache as a scratchpad your email server uses to remember things temporarily. This flaw lets an outside attacker, without needing a password, scribble false information onto that scratchpad — and that trick has been used by criminals as a stepping stone to plant ransomware on email systems. It's like someone slipping a fake note into your office's internal memo system that tricks staff into letting them in the back door.

Who is affected

This matters to you if you run a Zimbra Collaboration Suite (ZCS) email server, specifically version 8.8.15 or version 9.0. No login or user action is needed for an attacker to exploit it, so any internet-facing Zimbra server on these versions is at risk right now.

How urgent is it

This is a red-alert situation: attackers are already using this flaw in real ransomware campaigns, not just theoretical attacks. The U.S. government's cybersecurity agency added it to its list of actively exploited vulnerabilities and set a remediation deadline back in 2022, meaning organizations should have already patched — if you haven't, treat this as an active emergency, not a backlog item.

What to do — in detail

Identify all Zimbra Collaboration Suite instances and confirm exact version — vulnerable versions are 8.8.15 and 9.0 (pre-Patch 24).
Upgrade to 9.0.0 Patch 24 or later per https://wiki.zimbra.com/wiki/Zimbra_Releases/9.0.0/P24; review https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories for branch-specific guidance.
If immediate patching is not possible, restrict or firewall off memcache-related network paths and limit internet exposure to the Zimbra admin/service ports as a temporary mitigation.
Given this is a CISA KEV entry (added 2022-08-04, due date 2022-08-25) tied to ransomware campaigns, treat any unpatched instance as potentially already compromised — conduct forensic review of logs, scheduled tasks, web shells, and unexpected account changes.
After patching, monitor for anomalous memcache traffic, unexpected cache overwrites, and outbound connections indicative of post-exploitation tooling.
Validate patch application and confirm no persistence mechanisms remain before considering the system clean.

Technical context

CVSS 7.5 (High) — AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N, reflecting network-exploitable, low-complexity, unauthenticated integrity impact via CWE-74 (improper neutralization of special elements leading to injection). The flaw stems from unescaped memcache command injection in ZCS 8.8.15/9.0, reachable without authentication in default configuration. Confirmed active exploitation is documented in CISA KEV (added 2022-08-04, remediation due 2022-08-25) with association to ransomware campaigns; this confirmed-exploitation status supersedes any probabilistic EPSS scoring for prioritization purposes. Exploit maturity includes available detection templates; fix is delivered via vendor patch (9.0.0 Patch 24).

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS99th

CISA KEV

Listed as exploited in the wild since 2022-08-04.

US federal agencies must remediate by 2022-08-25.

Known use in ransomware campaigns.

Apply updates per vendor instructions.

Public exploits

No public exploit or proof of concept found in the sources we track.

EPSS

94% chance of exploitation activity in the next 30 days, which ranks it in the 99th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

17 events over 1626 days, from the signal feeds we watch.

2026-10-02EPSS band changehigh → criticalepss band change, patch available, record updated
2026-10-01Patch availablerecord updated
2026-08-04Patch availablerecord updated
2026-06-25OpenVAS check added
2026-06-22EPSS band changecritical → high
2026-03-06Nuclei check added

Affected products

Zimbra Inc.commercial · US
- Zimbra Collaboration SuiteMixedCommunications / email-server-client
synacorcommercial · US
- zimbra collaboration suiteWeb AppOn-premCommunications / email-server-client

And 1 more affected product. See all after sign-in

Technical detail

CVSS 3.1 vector

Open in the CVSS calculator

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Scored 7.5 by NVD.

How it is reached

Attack Vector NetworkExploitable remotely over the network without any special conditions
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required NoneNo authentication required — anyone can exploit this
User Interaction NoneNo user interaction needed — fully automated exploitation

Scope

Scope UnchangedImpact is limited to the vulnerable component itself

Impact if exploited

Confidentiality NoneNo confidentiality impact
Integrity HighTotal loss of integrity — attacker can modify any data in the component
Availability NoneNo availability impact