{"id":"CVE-2026-50056","kind":"vulnerability","aliases":["CVE-2026-50056"],"related":[],"title":"Zimbra: local user escalates to root via mailboxd JVM arguments","description":"A local privilege escalation vulnerability in the zmmailboxdmgr launcher of Zimbra Collaboration Suite (ZCS) allows the Unix zimbra account to execute arbitrary commands as root. The passwordless sudo interface accepts JVM arguments that are not adequately restricted. An attacker can postpone Jetty's privilege drop, register an OnOutOfMemoryError command and force heap exhaustion during startup, causing the command to execute while the JVM still runs as root. Exploitation requires local command execution as zimbra on a mailbox server and interrupts mailboxd during the malicious restart. ZCS 10.1.16 and 10.1.21 are affected.","summary":"The zmmailboxdmgr launcher in Zimbra Collaboration Suite passes JVM arguments through passwordless sudo without enough restriction. A local user running as the zimbra account can register an OutOfMemoryError command, force heap exhaustion during startup, and have that command run as root.","severity":"high","cvss":7.8,"epss":0.00216,"exploited":false,"exploited_at":null,"products":[{"name":"Zimbra Collaboration Suite","fixed":[],"affected":"<= 10.1.21","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["infrastructure","linux","local-privilege-escalation","mail-server","self-hosted","sudo","zimbra"],"not_affected_if":["auth-required","single-admin-host"],"how_to_check":"- Run su - zimbra -c 'zmcontrol -v'. CNA lists every release up to and including 10.1.21 as affected, not only 10.1.16 and 10.1.21.\n- Run sudo -l -U zimbra and look for NOPASSWD entries for zmmailboxdmgr (or /opt/zimbra/libexec/zmmailboxdmgr). Check who can log in or run code as the zimbra user.","fix":"unknown: no Zimbra fixed release published as of 2026-10-25; newest release is 10.1.21, which is listed as affected. Watch https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories","status":"open","published_at":"2026-10-23T14:17:53+00:00","first_seen_at":"2026-10-23T21:57:34+00:00","triaged_at":"2026-10-25T03:08:08+00:00","updated_at":"2026-10-25T12:38:49+00:00","category":"infrastructure","confidence":0.7,"triage":{"at":"2026-10-25T03:08:08Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Zimbra: local user escalates to root via mailboxd JVM arguments","impact":"high","summary":"The zmmailboxdmgr launcher in Zimbra Collaboration Suite passes JVM arguments through passwordless sudo without enough restriction. A local user running as the zimbra account can register an OutOfMemoryError command, force heap exhaustion during startup, and have that command run as root.","category":"infrastructure","nicknames":[],"who_cares":["zimbra","self-hosted","mail-server","linux"],"confidence":0.6,"needs_auth":"yes","worst_case":"local zimbra user gains root and runs arbitrary commands","analyst_note":"Fix version and vendor patch not stated in the NVD text; check the Zimbra security advisory for the patched release and any sudoers workaround.","how_to_check":"- Check the installed ZCS version with `su - zimbra -c \"zmcontrol -v\"` and compare against the affected releases `10.1.16` and `10.1.21`\n- Review sudo rules for the zimbra account with `sudo -l -U zimbra` for passwordless entries pointing at zmmailboxdmgr","needs_analyst":true,"not_affected_if":["auth-required"],"who_is_affected":"Zimbra Collaboration Suite mail servers on the affected releases, `10.1.16` and `10.1.21`, are exposed. The attacker must already run commands as the zimbra user on the mailbox server, so the risk is to shared or multi-tenant hosts and to servers where the zimbra account is reachable from other compromised services. Installations on other ZCS versions, or hosts where no one but administrators can log in as zimbra, are less exposed.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000661,"input_tokens":3459,"output_tokens":630,"severity_before":"high"},"analyst_status":"done","analyst_note":"Fix version and vendor patch not stated in the NVD text; check the Zimbra security advisory for the patched release and any sudoers workaround.","search":"'-2026':12A,15A '-50056':13A,16A '10.1.16':161C '10.1.21':163C 'accept':104C 'account':57B,93C 'adequ':110C 'affect':165C 'allow':89C 'arbitrari':96C 'argument':10A,43B,106C 'attack':113C 'caus':130C 'collabor':39B,86C 'collaboration':18A 'command':62B,71B,97C,123C,132C,145C 'cve':11A,14A 'drop':119C 'enough':48B 'escal':4A,25B,78C 'execut':95C,134C,146C 'exhaust':65B,127C 'exploit':142C 'forc':63B,125C 'heap':64B,126C 'host':31B 'infrastructur':20B 'interfac':103C 'interrupt':154C 'jetti':116C 'jvm':9A,42B,105C,137C 'launcher':36B,83C 'linux':21B 'local':2A,23B,51B,76C,144C 'local-privilege-escal':22B 'mail':27B 'mail-serv':26B 'mailbox':151C 'mailboxd':8A,155C 'malici':158C 'onoutofmemoryerror':122C 'outofmemoryerror':61B 'pass':41B 'passwordless':45B,101C 'postpon':115C 'privileg':24B,77C,118C 'regist':59B,120C 'requir':143C 'restart':159C 'restrict':49B,111C 'root':6A,74B,99C,141C 'run':53B,72B,139C 'self':30B 'self-host':29B 'server':28B,152C 'startup':67B,129C 'still':138C 'sudo':32B,46B,102C 'suit':40B,87C 'suite':19A 'unix':91C 'user':3A,52B 'via':7A 'vulner':79C 'without':47B 'zcs':88C,160C 'zimbra':1A,17A,33B,38B,56B,85C,92C,148C 'zmmailboxdmgr':35B,82C","nicknames":[],"mitigations":[],"who_affected":"Zimbra Collaboration Suite mail servers on the affected releases, `10.1.16` and `10.1.21`, are exposed. The attacker must already run commands as the zimbra user on the mailbox server, so the risk is to shared or multi-tenant hosts and to servers where the zimbra account is reachable from other compromised services. Installations on other ZCS versions, or hosts where no one but administrators can log in as zimbra, are less exposed.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-23T14:17:53+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"cve@rapid7.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-50056","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-50056","severity":null,"published_at":"2026-10-23T14:17:53+00:00","modified_at":"2026-10-23T16:44:17+00:00","first_seen_at":"2026-10-23T21:57:34+00:00","fetched_at":"2026-10-23T22:29:03+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-50056:679","url":null,"severity":null,"published_at":"2026-10-25T03:15:08+00:00","modified_at":"2026-10-25T03:15:08+00:00","first_seen_at":"2026-10-25T03:15:08+00:00","fetched_at":"2026-10-25T03:15:08+00:00","note":"CNA record (Rapid7) says ZCS affected 0 through 10.1.21; Zimbra advisories page (checked 2026-10-25) has no entry or fixed release for this CVE, so fix is unknown. Zimbra's own wiki says access to the zimbra UNIX account already implies root, a known weak trust model. No exploitation or PoC found (vuldb: no exploit). Nothing marked verified."},{"source":"epss","external_id":"CVE-2026-50056","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-50056","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-25T12:38:49+00:00","fetched_at":"2026-10-25T12:38:49+00:00","note":null}],"documents":[{"id":2060,"url":"https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories","title":"Zimbra Security Advisories (no entry for CVE-2026-50056 as of 2026-10-25)","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null},{"id":3081,"url":"https://wiki.zimbra.com/wiki/Security/Collab","title":"Zimbra Security/Collab: zimbra UNIX account to root trust model","kind":"vendor","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null},{"id":3083,"url":"https://www.cve.org/CVERecord?id=CVE-2026-50056","title":"CVE Record CVE-2026-50056 (CNA: Rapid7)","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}