Live › vulnerability › CVE-2026-93640
Go to dashboardThe optional dnscache package in Zimbra Collaboration Suite lets the unix zimbra account run zmunbound with arbitrary arguments through passwordless sudo. A crafted Unbound configuration keeps root privileges and can expose root-readable files such as password hashes and private keys, or overwrite privileged configuration files.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Zimbra Collaboration Suite installations that have the optional dnscache package and run ZCS 10.1.16 or 10.1.21, where the zimbra account has passwordless sudo for zmunbound. Only a local account that can act as zimbra can exploit it, so hosts without the dnscache package or on other versions can skip it.
No product ranges from the sources yet.
sudo -l -U zimbra and look for passwordless entries for zmunbound.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A local privilege escalation vulnerability in the optional dnscache package of Zimbra Collaboration Suite (ZCS) allows the Unix zimbra account to access files with root privileges. The passwordless sudo policy permits arbitrary arguments to zmunbound, whose wrapper forwards them to Unbound without restricting the configuration path. An attacker can supply a configuration that retains root privileges and disables the chroot. Include directives expose root-readable file contents through parser errors, while an attacker-selected logfile path creates a root-owned file or appends Unbound log records to an existing file. This can disclose password hashes and private keys and corrupt privileged configuration files, preventing affected services from starting with the modified configuration. The affected configuration is present in ZCS 10.1.16 and 10.1.21 dnscache packages.
This page as .md · .json · in your agent: get_signal("CVE-2026-93640")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.