CVE-2022-27924

High7.5Published on April 20, 2022

Zimbra Collaboration (aka ZCS) 8.8.15 and 9.0 allows an unauthenticated attacker to inject arbitrary memcache commands into a targeted instance. These memcache commands becomes unescaped, causing an overwrite of arbitrary cached entries.

Actively exploited

In the CISA exploited-vulnerabilities catalogue since Aug 4, 2022
US federal agencies must remediate it by Aug 25, 2022 (BOD 22-01)
First attack observed 105 days after disclosure
Used in ransomware campaigns

Apply updates per vendor instructions.

Source: CISA KEV · Oct 9, 2025 Feb 21, 2025 Oct 14, 2024 Oct 10, 2024 Oct 5, 2023 Aug 3, 2023

CVSS score7.5 / 10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Weakness type (CWE)CWE-74, CWE-74

Vendorssynacor

Affected products

Vendors	Product	Versions
synacor	zimbra collaboration suite	8.8.15

Vulnerabilities

Zimbra CVE-2026-73570 Exploited in the Wild: Who Needs to Patch Immediately

CVE-2026-73570 in Zimbra Collaboration is actively exploited. Learn who needs to patch immediately, the vulnerability details, and security steps.

Aug 20, 202623:094 min readRead

This product uses the NVD API but is not endorsed or certified by the NVD.

CVE database

Actively exploited

Affected products

Related articles

Zimbra CVE-2026-73570 Exploited in the Wild: Who Needs to Patch Immediately