PatchSiren

PatchSiren cyber security CVE debrief

CVE-2022-27925 Synacor CVE debrief

CVE-2022-27925 is a Synacor Zimbra Collaboration Suite (ZCS) vulnerability that CISA has classified as a Known Exploited Vulnerability (KEV). The public record describes it as an arbitrary file upload issue, and CISA’s notes also point to a Zimbra advisory discussing an authentication bypass in mailboxImportServlet. Because it is already in the KEV catalog and marked with known ransomware campaign use, defenders should treat it as urgent and apply vendor-directed updates immediately.

Vendor
Synacor
Product
Zimbra Collaboration Suite (ZCS)
CVSS
Unknown
CISA KEV
Listed
Original CVE published
2022-08-11
Original CVE updated
2022-08-11
Advisory published
2022-08-11
Advisory updated
2022-08-11

Who should care

Organizations running Synacor Zimbra Collaboration Suite (ZCS), especially internet-facing mail systems; security operations teams; IT administrators; and managed service providers responsible for patching and monitoring Zimbra deployments.

Technical summary

The supplied records identify CVE-2022-27925 as a Zimbra Collaboration Suite vulnerability involving arbitrary file upload. CISA’s KEV entry confirms active exploitation and notes a related Zimbra advisory about an authentication bypass in mailboxImportServlet. The combination of file-upload risk, public exploitation, and known ransomware campaign use makes exposed ZCS instances especially sensitive to compromise.

Defensive priority

Urgent

Recommended defensive actions

  • Apply updates per vendor instructions for Zimbra Collaboration Suite (ZCS) as soon as possible.
  • Inventory all ZCS instances, including externally reachable mail servers and test or standby systems.
  • Verify which hosts are exposed to the internet and prioritize those for immediate remediation.
  • Review authentication, upload, and application logs for suspicious activity around the affected time window.
  • If compromise is suspected, initiate incident response and hunt for unauthorized files, accounts, or web shell-like artifacts.
  • Track CISA KEV guidance and validate that remediation is completed before the KEV due date for affected systems.

Evidence notes

CVE-2022-27925 was published on 2022-08-11 and the CISA KEV entry was added the same day. The CVE title/description in the supplied corpus identify an arbitrary file upload vulnerability in Synacor Zimbra Collaboration Suite (ZCS). CISA’s KEV metadata marks known ransomware campaign use as 'Known' and directs defenders to apply updates per vendor instructions. The KEV notes also reference a Zimbra blog advisory about an authentication bypass in mailboxImportServlet, while the supplied NVD and CVE.org links provide the official vulnerability records.

Official resources

Publicly disclosed in the CVE record on 2022-08-11 and added to the CISA KEV catalog on 2022-08-11.