Live › vulnerability › CVE-2026-50057
Go to dashboardA flaw in the Zimbra Collaboration Suite MTA package lets the local zimbra account run arbitrary commands as root. The installed sudo policy allows passwordless root runs of Postfix admin commands without argument limits, so an attacker can point Postfix at a zimbra-writable directory and get a root-run program.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Zimbra Collaboration Suite installs running the MTA package on versions 10.1.16 and 10.1.21 are affected, based on the sources. Exploitation needs local command execution as the zimbra user, so the exposure is mainly on multi-user hosts or after another compromise. Hosts without ZCS or without the MTA package can skip it.
No product ranges from the sources yet.
su - zimbra -c 'zmcontrol -v') and compare against the affected releases 10.1.16 and 10.1.21sudo -l -U zimbra) and look for passwordless root entries for postfixls -ld /opt/zimbra/postfix/conf or the path used on your install)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A local privilege escalation vulnerability in the Zimbra Collaboration Suite (ZCS) MTA package allows the Unix zimbra account to execute arbitrary commands as root. The installed sudo policy permits passwordless root execution of Postfix administration commands without restricting their arguments. An attacker can select a zimbra-controlled daemon_directory in the Postfix configuration and invoke postfix set-permissions, causing Postfix to execute the attacker's post-install program as root. The Postfix configuration directory is also writable by zimbra, so restricting postconf alone does not remove the execution path. Exploitation requires local command execution as zimbra on an MTA node. ZCS 10.1.16 and 10.1.21 are affected.
This page as .md · .json · in your agent: get_signal("CVE-2026-50057")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.