CVE-2022-27924: Zimbra Collaboration memcache command injection via unauthenticated request

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

critical priorityUnauthenticated network-reachable integrity compromise of a widely deployed mail platform, listed in CISA KEV with known ransomware use and a very high EPSS score.

What it is

Zimbra Collaboration Suite 8.8.15 and 9.0 allows an unauthenticated attacker to inject arbitrary memcache commands into a targeted instance. The injected commands are not escaped, allowing overwrite of arbitrary cached entries. This matters because it lets an external attacker tamper with server-side cached data without credentials.

Impact

An attacker can overwrite arbitrary memcache entries, corrupting or manipulating cached data the application relies on. The CVSS vector shows high integrity impact with no confidentiality or availability impact.

Attack surface

Reachable over the network with no authentication and no user interaction required, per the CVSS vector AV:N/AC:L/PR:N/UI:N. The description states the attacker targets a Zimbra instance directly.

Exploitation

It is listed in CISA KEV with a due date of 2022-08-25 and flagged for known ransomware campaign use, and EPSS shows a 30-day probability of 0.854 at the 99.7th percentile. References are vendor advisories and a US government resource; no public exploit code is cited in the record.

What to do

• Apply the vendor updates referenced in the Zimbra security advisories and release notes (9.0.0 P24 and the corresponding 8.8.15 patch).
• Restrict network access to Zimbra services so untrusted clients cannot reach the affected endpoints.
• Monitor and, where feasible, isolate or harden the memcache service used by Zimbra so it is not reachable from untrusted networks.
• Verify patched versions are actually deployed across all Zimbra nodes, since the flaw affects both 8.8.15 and 9.0.

Detection

• Inspect Zimbra and memcache logs for unexpected or malformed memcache commands originating from external clients.
• Alert on anomalous changes to cached entries or cache contents that do not correlate with normal application activity.
• Monitor network traffic to the memcache port for connections from sources outside the expected Zimbra host set.
• Hunt for exploitation attempts against Zimbra endpoints using the vendor advisory and KEV listing as context for known attack patterns.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.