CVE Watch—

CVE-2022-37042

Synacor Zimbra Collaboration Suite (ZCS) Authentication Bypass Vulnerability

CVSS

—

No CVSS

EPSS

88.3%

p100

KEV

YES

Aug 11, 2022

Exploit Today

0-100

Published: — · Last modified: —

EPSS · 30d

88.3%EPSS · 30 days88.3%

2026-06-302026-07-16

KEV catalog record

Product

Synacor / Zimbra Collaboration Suite (ZCS)

Vulnerability

Synacor Zimbra Collaboration Suite (ZCS) Authentication Bypass Vulnerability

Added to KEV

Aug 11, 2022

Remediate by

Sep 1, 2022

Known ransomware use

Yes

Summary description

Synacor Zimbra Collaboration Suite (ZCS) contains an authentication bypass vulnerability in MailboxImportServlet. This vulnerability was chained with CVE-2022-27925 which allows for unauthenticated remote code execution.

Required action

Apply updates per vendor instructions.

Notes

https://blog.zimbra.com/2022/08/authentication-bypass-in-mailboximportservlet-vulnerability/; https://nvd.nist.gov/vuln/detail/CVE-2022-37042

Related CVEs

CVECVSSEPSSKEVRExploitTitleMod.

CVE-2024-45519—

100.0%

KEV—80Synacor Zimbra Collaboration Suite (ZCS) Command Execution Vulnerability—CVE-2019-9670—

100.0%

KEV—80Synacor Zimbra Collaboration Suite (ZCS) Improper Restriction of XML External Entity Reference—CVE-2022-27925—

99.9%

KEV—80Synacor Zimbra Collaboration Suite (ZCS) Arbitrary File Upload Vulnerability—CVE-2022-41352—

99.9%

KEV—80Synacor Zimbra Collaboration Suite (ZCS) Arbitrary File Upload Vulnerability—CVE-2022-27924—

99.7%

KEV—80Synacor Zimbra Collaboration Suite (ZCS) Command Injection Vulnerability—CVE-2019-9621—

99.6%

KEV—80Synacor Zimbra Collaboration Suite (ZCS) Server-Side Request Forgery (SSRF) Vulnerability—