{"id":"CVE-2026-93640","kind":"vulnerability","aliases":["CVE-2026-93640"],"related":[],"title":"Zimbra dnscache package: local user can read root files via sudo","description":"A local privilege escalation vulnerability in the optional dnscache package of Zimbra Collaboration Suite (ZCS) allows the Unix zimbra account to access files with root privileges. The passwordless sudo policy permits arbitrary arguments to zmunbound, whose wrapper forwards them to Unbound without restricting the configuration path. An attacker can supply a configuration that retains root privileges and disables the chroot. Include directives expose root-readable file contents through parser errors, while an attacker-selected logfile path creates a root-owned file or appends Unbound log records to an existing file. This can disclose password hashes and private keys and corrupt privileged configuration files, preventing affected services from starting with the modified configuration. The affected configuration is present in ZCS 10.1.16 and 10.1.21 dnscache packages.","summary":"The optional dnscache package in Zimbra Collaboration Suite lets the unix zimbra account run zmunbound with arbitrary arguments through passwordless sudo. A crafted Unbound configuration keeps root privileges and can expose root-readable files such as password hashes and private keys, or overwrite privileged configuration files.","severity":"high","cvss":7.8,"epss":0.0014,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["email","infrastructure","linux","self-hosted","zimbra"],"not_affected_if":["no-dnscache-package","other-zcs-versions"],"how_to_check":"- Check whether the dnscache package is installed on the Zimbra host and note the ZCS version (ZCS 10.1.16 and 10.1.21 are named as affected).\n- Run `sudo -l -U zimbra` and look for passwordless entries for zmunbound.","fix":"- Upgrade ZCS to a release that includes the fix; the sources do not name the fixed version.\n- Remove the dnscache package or the sudo rule for zmunbound if it is not needed; this is an inference, not stated in the sources.","status":"open","published_at":"2026-10-23T14:17:57+00:00","first_seen_at":"2026-10-23T21:57:34+00:00","triaged_at":"2026-10-25T03:08:04+00:00","updated_at":"2026-10-25T12:38:49+00:00","category":"infrastructure","confidence":0.7,"triage":{"at":"2026-10-25T03:08:04Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade ZCS to a release that includes the fix; the sources do not name the fixed version.\n- Remove the dnscache package or the sudo rule for zmunbound if it is not needed; this is an inference, not stated in the sources.","reach":"local","title":"Zimbra dnscache package: local user can read root files via sudo","impact":"high","summary":"The optional dnscache package in Zimbra Collaboration Suite lets the unix zimbra account run zmunbound with arbitrary arguments through passwordless sudo. A crafted Unbound configuration keeps root privileges and can expose root-readable files such as password hashes and private keys, or overwrite privileged configuration files.","category":"infrastructure","nicknames":[],"who_cares":["zimbra","self-hosted","linux","email"],"confidence":0.7,"needs_auth":"yes","worst_case":"local user gains root file read and write access","analyst_note":"Find the fixed ZCS version and the sudoers change in the NVD entry or Zimbra advisory to confirm the fix steps.","how_to_check":"- Check whether the dnscache package is installed on the Zimbra host and note the ZCS version (ZCS 10.1.16 and 10.1.21 are named as affected).\n- Run `sudo -l -U zimbra` and look for passwordless entries for zmunbound.","needs_analyst":true,"not_affected_if":["no-dnscache-package","other-zcs-versions"],"who_is_affected":"Zimbra Collaboration Suite installations that have the optional dnscache package and run ZCS 10.1.16 or 10.1.21, where the zimbra account has passwordless sudo for zmunbound. Only a local account that can act as zimbra can exploit it, so hosts without the dnscache package or on other versions can skip it.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000675,"input_tokens":3494,"output_tokens":651,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-93640':14A,17A '10.1.16':194C '10.1.21':196C 'access':93C 'account':37B,91C 'affect':179C,188C 'allow':87C 'append':157C 'arbitrari':41B,103C 'argument':42B,104C 'attack':119C,146C 'attacker-select':145C 'chroot':131C 'collabor':31B,84C 'configur':49B,70B,116C,123C,176C,186C,189C 'content':139C 'corrupt':174C 'craft':47B 'creat':150C 'cve':12A,15A 'direct':133C 'disabl':129C 'disclos':167C 'dnscach':2A,27B,80C,197C 'email':18B 'error':142C 'escal':75C 'exist':163C 'expos':55B,134C 'file':9A,59B,71B,94C,138C,155C,164C,177C 'forward':109C 'hash':63B,169C 'host':23B 'includ':132C 'infrastructur':19B 'keep':50B 'key':66B,172C 'let':33B 'linux':20B 'local':4A,73C 'log':159C 'logfil':148C 'modifi':185C 'option':26B,79C 'overwrit':68B 'own':154C 'packag':3A,28B,81C,198C 'parser':141C 'password':62B,168C 'passwordless':44B,99C 'path':117C,149C 'permit':102C 'polici':101C 'present':191C 'prevent':178C 'privat':65B,171C 'privileg':52B,69B,74C,97C,127C,175C 'read':7A 'readabl':58B,137C 'record':160C 'restrict':114C 'retain':125C 'root':8A,51B,57B,96C,126C,136C,153C 'root-own':152C 'root-read':56B,135C 'run':38B 'select':147C 'self':22B 'self-host':21B 'servic':180C 'start':182C 'sudo':11A,45B,100C 'suit':32B,85C 'suppli':121C 'unbound':48B,112C,158C 'unix':35B,89C 'user':5A 'via':10A 'vulner':76C 'whose':107C 'without':113C 'wrapper':108C 'zcs':86C,193C 'zimbra':1A,24B,30B,36B,83C,90C 'zmunbound':39B,106C","nicknames":[],"mitigations":[],"who_affected":"Zimbra Collaboration Suite installations that have the optional dnscache package and run ZCS 10.1.16 or 10.1.21, where the zimbra account has passwordless sudo for zmunbound. Only a local account that can act as zimbra can exploit it, so hosts without the dnscache package or on other versions can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-23T14:17:57+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"cve@rapid7.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-93640","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-93640","severity":null,"published_at":"2026-10-23T14:17:57+00:00","modified_at":"2026-10-23T16:44:17+00:00","first_seen_at":"2026-10-23T21:57:34+00:00","fetched_at":"2026-10-23T22:29:03+00:00","note":null},{"source":"epss","external_id":"CVE-2026-93640","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-93640","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-25T12:38:49+00:00","fetched_at":"2026-10-25T12:38:49+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}