CVE-2022-37042: Zimbra Collaboration Suite mboximport auth bypass path traversal RCE

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

critical priorityUnauthenticated network RCE with active exploitation, KEV listing, ransomware use, and near-maximum EPSS.

What it is

Zimbra Collaboration Suite 8.8.15 and 9.0 mboximport accepts a ZIP archive and extracts files without requiring an authtoken, allowing unauthenticated upload of arbitrary files. The incomplete fix for CVE-2022-27925 leaves a path traversal that can lead to remote code execution.

Impact

An unauthenticated attacker can write arbitrary files to the server and achieve remote code execution, gaining full control of the Zimbra host.

Attack surface

Reachable over the network via the mboximport functionality; no authentication or user interaction is required per the CVSS vector (AV:N/AC:L/PR:N/UI:N).

Exploitation

CISA KEV lists it as actively exploited with known ransomware campaign use, and EPSS is 0.91893 (99.8th percentile); a public exploit reference exists.

What to do

• Apply the vendor patch from the Zimbra Security Center immediately.
• Restrict network access to Zimbra administrative and mboximport endpoints to trusted sources.
• Verify the CVE-2022-27925 fix is fully applied, since this is an incomplete-fix bypass.
• Monitor for unexpected file writes or web shells in Zimbra directories.

Detection

• Inspect Zimbra logs for mboximport requests lacking a valid authtoken.
• Alert on ZIP uploads containing path traversal sequences such as ../.
• Monitor for new or modified executable files in Zimbra web and mail directories.
• Correlate outbound connections from the Zimbra host with file-write events.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.