CVE-2022-27924

Unpatched command injection flaw in Synacor Zimbra allowed memcache command injection leading to arbitrary cache overwrites and active ransomware exploitation.

Synacor's Zimbra Collaboration Suite suffered from a critical command injection vulnerability that allowed attackers to inject memcache commands, overwriting arbitrary cached entries. This unpatched flaw was actively exploited in ransomware campaigns, demonstrating Synacor's chronic failure to patch critical vulnerabilities before they were weaponized. DIB organizations using Zimbra must urgently patch this CVE and assess their exposure to similar unpatched RCE flaws that threaten data integrity and availability.

Shame score — A critical unpatched command injection flaw was actively exploited in ransomware campaigns, reflecting Synacor's chronic vulnerability management failure and systemic inability to patch critical flaws before they were weaponized.