UPDATE to 6/17/2022 FLASH UPDATE: The Cybersecurity and Infrastructure Security Agency (CISA) has added an actively exploited zero-click high-severity vulnerability to its Known Exploited Vulnerabilities (KEV) catalog. This flaw affects an enterprise email solution called Zimbra, and was identified in March 2022, and patched in in May 2022. In June 2022, SonarSource published an in-depth technical writeup on their blog, and today hackers are using the report to reverse engineer the exploit and look for unpatched vulnerable instances to attack in-the-wild. The vulnerability, tracked as CVE-2022-27924, is a Memcache poisoning with an unauthenticated request flaw caused by CRLF (Carriage Return, Line Feed) injection. In a CRLF injection, the attacker injects special characters into a web application, allowing them to falsify log file entries or add extra HTTP headers to a response to perform cross-site-scripting (XSS) attacks. If exploited, this vulnerability could allow unauthenticated attackers to steal credentials for victim email accounts, as well as tricking Zimbra into forwarding email traffic to the attacker by overwriting Internet message Access Protocol (IMAP) route entries that forward when the authorized user logs-in. This exploit is avoidable in instances of Zimbra that have applied the May 2022 patch, but enough Zimbra administrators have failed to update their instances that CISA has been forced to step in. With the adding of this exploit to the KEV catalog, Federal Civilian Executive Branch (FCEB) agencies are now obligated to remediate this vulnerability in accordance with CISA’s Binding Operational Directive (BOD) 22-01. This flaw carries significant risk to the federal enterprise, and failure to comply with BOD 22-01 could lead to heavy fines against the negligent party. CTIX analysts recommend that all agencies and companies utilizing the Zimbra email platform, update to the most recent secure version of the solution.