ACTIVELY EXPLOITED
CVE-2022-27925: Synacor Zimbra Collaboration Suite (ZCS) Arbitrary File Upload Vulnerability
| Vendor | Synacor |
|---|---|
| Product | Zimbra Collaboration Suite (ZCS) |
| Actively exploited | Yes |
| Added to CISA KEV | 11 Aug 2022 |
| CISA federal deadline | 1 Sep 2022 |
| Ransomware use | Known |
| Weakness (CWE) | CWE-22 |
Required action (CISA's text)
Apply updates per vendor instructions.
Description (NVD)
Synacor Zimbra Collaboration Suite (ZCS) contains flaw in the mboximport functionality, allowing an authenticated attacker to upload arbitrary files to perform remote code execution. This vulnerability was chained with CVE-2022-37042 which allows for unauthenticated remote code execution.
SOURCES
Other Synacor flaws
- CVE-2026-73570: Zimbra Collaboration Suite (ZCS) OS Command Injection Vulnerability
- CVE-2025-48700: Synacor Zimbra Collaboration Suite (ZCS) Cross-site Scripting Vulnerability
- CVE-2025-66376: Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting Vulnerability
- CVE-2020-7796: Synacor Zimbra Collaboration Suite (ZCS) Server-Side Request Forgery Vulnerability
- CVE-2025-68645: Synacor Zimbra Collaboration Suite (ZCS) PHP Remote File Inclusion Vulnerability
Data from NVD, CISA KEV, FIRST EPSS and vendor advisories. Updated 10 Nov 2026.