CVE-2022-27924
Synacor Zimbra Collaboration Suite (ZCS) Command Injection Vulnerability
Published Apr 20, 2022 · updated Oct 2, 2026 · synacor zimbra collaboration suite
Zimbra Collaboration (aka ZCS) 8.8.15 and 9.0 allows an unauthenticated attacker to inject arbitrary memcache commands into a targeted instance. These memcache commands becomes unescaped, causing an overwrite of arbitrary cached entries.
Timeline
Detection, updates, and resolution for this record.
Apr 20, 2022 · Catalog
Detected
Zimbra Collaboration (aka ZCS) 8.8.15 and 9.0 allows an unauthenticated attacker to inject arbitrary memcache commands into a targeted instance. These memcache commands becomes unescaped, causing an overwrite of arbitrary cached entries.
Aug 4, 2022 · CISA KEV
Known exploited
Apply updates per vendor instructions.
Aug 25, 2022 · CISA KEV
Remediation due
Apply updates per vendor instructions.
Oct 2, 2026 · Catalog
Updated
Zimbra Collaboration (aka ZCS) 8.8.15 and 9.0 allows an unauthenticated attacker to inject arbitrary memcache commands into a targeted instance. These memcache commands becomes unescaped, causing an overwrite of arbitrary cached entries.
Required action
Apply updates per vendor instructions.
CISA due date Aug 25, 2022
Affected
- cpe synacor/zimbra collaboration suite8.8.15
- vendor Synacor Zimbra Collaboration Suite (ZCS)version unspecified
Sources
- CISA KEVCVE-2022-27924
Synacor Zimbra Collaboration Suite (ZCS) allows an attacker to inject memcache commands into a targeted instance which causes an overwrite of arbitrary cached entries.
cisa.gov - CVE.orgCVE-2022-27924
Official CVE identifier
cve.org - FIRST EPSSCVE-2022-27924
30-day exploitation probability 93.9%
first.org - NIST NVDCVE-2022-27924
Zimbra Collaboration (aka ZCS) 8.8.15 and 9.0 allows an unauthenticated attacker to inject arbitrary memcache commands into a targeted instance. These memcache commands becomes unescaped, causing an overwrite of arbitrary cached entries.
nvd.nist.gov