CVE
CVE-2022-37042
- First Reported
- Sep 24, 2026
- Latest Reported
- Sep 24, 2026
CVE Enrichment
- CVSS
- 9.8 CRITICAL
- EPSS
- 91.89%
- EPSS Percentile
- 99.82%
- CISA KEV
- YES — Known Exploited Vulnerability
Description
Zimbra Collaboration Suite (ZCS) 8.8.15 and 9.0 has mboximport functionality that receives a ZIP archive and extracts files from it. By bypassing authentication (i.e., not having an authtoken), an attacker can upload arbitrary files to the system, leading to directory traversal and remote code execution. NOTE: this issue exists because of an incomplete fix for CVE-2022-27925.
Technical Details
- CVSS Version
- 3.1
- CNA / NVD Source
- cve@mitre.org
- Published
- 12-Aug-2022 22:15
- Last Modified
- 04-Aug-2026 12:16
- EPSS Date
- 2026-10-11
- CWE
- CWE-22
CVSS Vector
CVSS:3.1 AV:N /
AC:L /
PR:N /
UI:N /
S:U /
C:H /
I:H /
A:H
CISA KEV Details
- Date Added
- 2022-08-11
- Remediation Due
- 2022-09-01
- Known Ransomware Campaign Use
- Known
- Required Action
- Apply updates per vendor instructions.
- Notes
- https://blog.zimbra.com/2022/08/authentication-bypass-in-mailboximportservlet-vulnerability/; https://nvd.nist.gov/vuln/detail/CVE-2022-37042
Affected Products / Versions
- synacor / zimbra_collaboration_suite
Version / affected range: 8.8.15
cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:-:*:*:*:*:*:* - synacor / zimbra_collaboration_suite
Version / affected range: 8.8.15
cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p1:*:*:*:*:*:* - synacor / zimbra_collaboration_suite
Version / affected range: 8.8.15
cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p10:*:*:*:*:*:* - synacor / zimbra_collaboration_suite
Version / affected range: 8.8.15
cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p11:*:*:*:*:*:* - synacor / zimbra_collaboration_suite
Version / affected range: 8.8.15
cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p12:*:*:*:*:*:* - synacor / zimbra_collaboration_suite
Version / affected range: 8.8.15
cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p13:*:*:*:*:*:* - synacor / zimbra_collaboration_suite
Version / affected range: 8.8.15
cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p14:*:*:*:*:*:* - synacor / zimbra_collaboration_suite
Version / affected range: 8.8.15
cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p15:*:*:*:*:*:* - synacor / zimbra_collaboration_suite
Version / affected range: 8.8.15
cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p16:*:*:*:*:*:* - synacor / zimbra_collaboration_suite
Version / affected range: 8.8.15
cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p17:*:*:*:*:*:* - synacor / zimbra_collaboration_suite
Version / affected range: 8.8.15
cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p18:*:*:*:*:*:* - synacor / zimbra_collaboration_suite
Version / affected range: 8.8.15
cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p19:*:*:*:*:*:* - synacor / zimbra_collaboration_suite
Version / affected range: 8.8.15
cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p2:*:*:*:*:*:* - synacor / zimbra_collaboration_suite
Version / affected range: 8.8.15
cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p20:*:*:*:*:*:* - synacor / zimbra_collaboration_suite
Version / affected range: 8.8.15
cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p21:*:*:*:*:*:* - synacor / zimbra_collaboration_suite
Version / affected range: 8.8.15
cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p22:*:*:*:*:*:* - synacor / zimbra_collaboration_suite
Version / affected range: 8.8.15
cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p23:*:*:*:*:*:* - synacor / zimbra_collaboration_suite
Version / affected range: 8.8.15
cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p24:*:*:*:*:*:* - synacor / zimbra_collaboration_suite
Version / affected range: 8.8.15
cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p25:*:*:*:*:*:* - synacor / zimbra_collaboration_suite
Version / affected range: 8.8.15
cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p26:*:*:*:*:*:* - synacor / zimbra_collaboration_suite
Version / affected range: 8.8.15
cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p27:*:*:*:*:*:* - synacor / zimbra_collaboration_suite
Version / affected range: 8.8.15
cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p28:*:*:*:*:*:* - synacor / zimbra_collaboration_suite
Version / affected range: 8.8.15
cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p29:*:*:*:*:*:* - synacor / zimbra_collaboration_suite
Version / affected range: 8.8.15
cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p3:*:*:*:*:*:* - synacor / zimbra_collaboration_suite
Version / affected range: 8.8.15
cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p30:*:*:*:*:*:* - synacor / zimbra_collaboration_suite
Version / affected range: 8.8.15
cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p31:*:*:*:*:*:* - synacor / zimbra_collaboration_suite
Version / affected range: 8.8.15
cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p31.1:*:*:*:*:*:* - synacor / zimbra_collaboration_suite
Version / affected range: 8.8.15
cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p32:*:*:*:*:*:* - synacor / zimbra_collaboration_suite
Version / affected range: 8.8.15
cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p4:*:*:*:*:*:* - synacor / zimbra_collaboration_suite
Version / affected range: 8.8.15
cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p5:*:*:*:*:*:* - synacor / zimbra_collaboration_suite
Version / affected range: 8.8.15
cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p6:*:*:*:*:*:* - synacor / zimbra_collaboration_suite
Version / affected range: 8.8.15
cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p7:*:*:*:*:*:* - synacor / zimbra_collaboration_suite
Version / affected range: 8.8.15
cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p8:*:*:*:*:*:* - synacor / zimbra_collaboration_suite
Version / affected range: 8.8.15
cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p9:*:*:*:*:*:* - synacor / zimbra_collaboration_suite
Version / affected range: 9.0.0
cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:-:*:*:*:*:*:* - synacor / zimbra_collaboration_suite
Version / affected range: 9.0.0
cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p1:*:*:*:*:*:* - synacor / zimbra_collaboration_suite
Version / affected range: 9.0.0
cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p10:*:*:*:*:*:* - synacor / zimbra_collaboration_suite
Version / affected range: 9.0.0
cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p11:*:*:*:*:*:* - synacor / zimbra_collaboration_suite
Version / affected range: 9.0.0
cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p12:*:*:*:*:*:* - synacor / zimbra_collaboration_suite
Version / affected range: 9.0.0
cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p13:*:*:*:*:*:* - synacor / zimbra_collaboration_suite
Version / affected range: 9.0.0
cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p14:*:*:*:*:*:* - synacor / zimbra_collaboration_suite
Version / affected range: 9.0.0
cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p15:*:*:*:*:*:* - synacor / zimbra_collaboration_suite
Version / affected range: 9.0.0
cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p16:*:*:*:*:*:* - synacor / zimbra_collaboration_suite
Version / affected range: 9.0.0
cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p17:*:*:*:*:*:* - synacor / zimbra_collaboration_suite
Version / affected range: 9.0.0
cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p18:*:*:*:*:*:* - synacor / zimbra_collaboration_suite
Version / affected range: 9.0.0
cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p19:*:*:*:*:*:* - synacor / zimbra_collaboration_suite
Version / affected range: 9.0.0
cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p2:*:*:*:*:*:* - synacor / zimbra_collaboration_suite
Version / affected range: 9.0.0
cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p20:*:*:*:*:*:* - synacor / zimbra_collaboration_suite
Version / affected range: 9.0.0
cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p21:*:*:*:*:*:* - synacor / zimbra_collaboration_suite
Version / affected range: 9.0.0
cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p22:*:*:*:*:*:* - synacor / zimbra_collaboration_suite
Version / affected range: 9.0.0
cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p23:*:*:*:*:*:* - synacor / zimbra_collaboration_suite
Version / affected range: 9.0.0
cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p24:*:*:*:*:*:* - synacor / zimbra_collaboration_suite
Version / affected range: 9.0.0
cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p24.1:*:*:*:*:*:* - synacor / zimbra_collaboration_suite
Version / affected range: 9.0.0
cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p25:*:*:*:*:*:* - synacor / zimbra_collaboration_suite
Version / affected range: 9.0.0
cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p3:*:*:*:*:*:* - synacor / zimbra_collaboration_suite
Version / affected range: 9.0.0
cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p4:*:*:*:*:*:* - synacor / zimbra_collaboration_suite
Version / affected range: 9.0.0
cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p5:*:*:*:*:*:* - synacor / zimbra_collaboration_suite
Version / affected range: 9.0.0
cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p6:*:*:*:*:*:* - synacor / zimbra_collaboration_suite
Version / affected range: 9.0.0
cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p7:*:*:*:*:*:* - synacor / zimbra_collaboration_suite
Version / affected range: 9.0.0
cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p8:*:*:*:*:*:* - synacor / zimbra_collaboration_suite
Version / affected range: 9.0.0
cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p9:*:*:*:*:*:*
References
- af854a3a-2127-422b-91ae-364da2661108
- af854a3a-2127-422b-91ae-364da2661108
- af854a3a-2127-422b-91ae-364da2661108
- CISA Advisory
Sources: NVD · FIRST EPSS · CISA KEV
Latest successful provider update; providers refresh independently.
Reported Context (1)
- Go back further and the pattern holds. Rapid7 tracked widespread exploitation of CVE-2022-27925 and CVE-2022-37042 in 2022, a path traversal chained with an authentication bypass that let attackers drop a JSP shell on a Zimbra Vulnerabilities Could Let Attackers Manipulate Email, Documents and Calendars
CVE (5)
Vendors (1)
Products (2)
Industries (1)
Countries (2)
Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.