Zimbra Collaboration Suite Local Privilege Escalation via zmmailboxdmgr JVM Argument Injection

Exact source revision recorded 24 Oct 2026 04:48:20 UTC. It does not establish the source's current position. Latest evidence.

Recorded JSON

cve-program · CVE-2026-50056

Published

A local privilege escalation vulnerability in the zmmailboxdmgr launcher of Zimbra Collaboration Suite (ZCS) allows the Unix zimbra account to execute arbitrary commands as root. The passwordless sudo interface accepts JVM arguments that are not adequately restricted. An attacker can postpone Jetty's privilege drop, register an OnOutOfMemoryError command and force heap exhaustion during startup, causing the command to execute while the JVM still runs as root. Exploitation requires local command execution as zimbra on a mailbox server and interrupts mailboxd during the malicious restart. ZCS 10.1.16 and 10.1.21 are affected.

Source published: 23 Oct 2026 13:30:43 UTC
Source modified: 24 Oct 2026 03:55:30 UTC
Observed here: 24 Oct 2026 04:48:20 UTC
Source terms: CVE Program Terms of Use

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: cve-program · CVE Program Terms of Use. Source text is retained; field grouping and change labels are provided by ChangeIntel.

CVSS 3.1 · 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H