---
id: "CVE-2026-50056"
kind: "vulnerability"
aliases: ["CVE-2026-50056"]
title: "Zimbra: local user escalates to root via mailboxd JVM arguments"
severity: "high"
cvss: 7.8
epss: 0.00216
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "Zimbra Collaboration Suite", "fixed": [], "affected": "<= 10.1.21", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["infrastructure", "linux", "local-privilege-escalation", "mail-server", "self-hosted", "sudo", "zimbra"]
not_affected_if: ["auth-required", "single-admin-host"]
published_at: "2026-10-23T14:17:53+00:00"
first_seen_at: "2026-10-23T21:57:34+00:00"
updated_at: "2026-10-25T12:38:49+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-50056", "first_seen_at": "2026-10-23T21:57:34+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-25T03:15:08+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-50056", "first_seen_at": "2026-10-25T12:38:49+00:00"}]
---

# Zimbra: local user escalates to root via mailboxd JVM arguments

The zmmailboxdmgr launcher in Zimbra Collaboration Suite passes JVM arguments through passwordless sudo without enough restriction. A local user running as the zimbra account can register an OutOfMemoryError command, force heap exhaustion during startup, and have that command run as root.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Zimbra Collaboration Suite affected <= 10.1.21 fixed ?

## How to check

- Run su - zimbra -c 'zmcontrol -v'. CNA lists every release up to and including 10.1.21 as affected, not only 10.1.16 and 10.1.21.
- Run sudo -l -U zimbra and look for NOPASSWD entries for zmmailboxdmgr (or /opt/zimbra/libexec/zmmailboxdmgr). Check who can log in or run code as the zimbra user.

## Fix

unknown: no Zimbra fixed release published as of 2026-10-25; newest release is 10.1.21, which is listed as affected. Watch https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories

## Timeline

- 2026-10-23T21:57:34+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-50056
- 2026-10-25T03:15:08+00:00 analyst — CNA record (Rapid7) says ZCS affected 0 through 10.1.21; Zimbra advisories page (checked 2026-10-25) has no entry or fixed release for this CVE, so fix is unknown. Zimbra's own wiki says access to the zimbra UNIX account already implies root, a known weak trust model. No exploitation or PoC found (vuldb: no exploit). Nothing marked verified.
- 2026-10-25T12:38:49+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-50056

## Documents

- [advisory] CVE Record CVE-2026-50056 (CNA: Rapid7) https://www.cve.org/CVERecord?id=CVE-2026-50056
- [describes] Zimbra Security/Collab: zimbra UNIX account to root trust model https://wiki.zimbra.com/wiki/Security/Collab
- [mentions] Zimbra Security Advisories (no entry for CVE-2026-50056 as of 2026-10-25) https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories

## From the sources

A local privilege escalation vulnerability in the zmmailboxdmgr launcher of Zimbra Collaboration Suite (ZCS) allows the Unix zimbra account to execute arbitrary commands as root. The passwordless sudo interface accepts JVM arguments that are not adequately restricted. An attacker can postpone Jetty's privilege drop, register an OnOutOfMemoryError command and force heap exhaustion during startup, causing the command to execute while the JVM still runs as root. Exploitation requires local command execution as zimbra on a mailbox server and interrupts mailboxd during the malicious restart. ZCS 10.1.16 and 10.1.21 are affected.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_