ctrlINT What the industry said about every indicator, with the quote

CVE-2022-27925Vulnerability

Synacor Zimbra Collaboration Suite (ZCS) Arbitrary File Upload Vulnerability

Exploited in the wildCISA added it to its Known Exploited Vulnerabilities list on .

Reported by 3 independent sources · first reported by GreyNoise · last reported

Last reported 30 days ago

CISA KEVAdded 11 Aug 2022
Fix due 1 Sep 2022
Used by ransomware: knownCISA KEV catalogue
EPSS98.7%
higher than 99% of CVEsFIRST EPSS, as of 21 Oct 2026

What the reports say

4 reports, newest first · the exact sentence from each

  1. “Rapid7 tracked widespread exploitation of CVE-2022-27925 and CVE-2022-37042 in 2022, a path traversal chained with an authentication bypass that let attackers drop a JSP shell on a Zimbra server without credentials.”

    Rapid7Vendor
    When Business Email Compromise Starts Rewriting Reality

  2. “CVE-2022-27925”

    Recorded FutureVendor
    August 2026 CVE Landscape

  3. “CVE-2022-27925”

    Recorded FutureVendor
    June 2026 CVE Landscape

  4. “CVE-2022-27925 – Synacor Zimbra Collaboration Suite (ZCS) Arbitrary File Upload Vulnerability”

    GreyNoiseVendor
    GreyNoise Detects Active Exploitation of CVEs Mentioned in Black Basta’s Leaked Chat Logs

Indicators reported together

named in the same reports

Also named with it: CVE-2026-12569, CVE-2017-5753, CVE-2020-1472, CVE-2026-73570, CVE-2023-46747, CVE-2021-26855, CVE-2023-20198, CVE-2024-21762, CVE-2022-41082, CVE-2022-37042, CVE-2025-49113, CVE-2026-68820, CVE-2026-65400, CVE-2026-60004, CVE-2026-64849, CVE-2026-33824, CVE-2026-25089, CVE-2026-39808, CVE-2026-11645, CVE-2026-28318

Thanks — we review every report.

Report a wrong value
What is wrong with CVE-2022-27925 here?
No account needed. We do not store your IP address.