Zimbra Collaboration Suite: Local privilege escalation to root via zmmailboxdmgr
Summary
A flaw in the zmmailboxdmgr launcher of Zimbra Collaboration Suite (ZCS) allows a local user with the zimbra account to run arbitrary commands as root. The passwordless sudo interface accepts insufficiently restricted JVM arguments, which lets an attacker postpone Jetty's privilege drop and trigger a command during forced heap exhaustion at startup. An attacker needs existing command execution as zimbra on the mailbox server, and the exploit interrupts mailboxd during the malicious restart.
Affected
- Zimbra Collaboration Suite up to and including 10.1.21 (CNA range 0 to <= 10.1.21)
- ZCS 10.1.16 is named in one secondary source; treat all 10.1.x up to 10.1.21 as potentially affected until Zimbra confirms the range
Fixed in
Unknown. No fixed version is confirmed in the sources reviewed.
Workaround
- Restrict sudo rights of the zimbra account to essential commands only, without JVM argument options (interim measure from a secondary source, validate before rollout)
- Monitor configuration files related to zmmailboxdmgr and log mailboxd out-of-memory and restart events
Exploitation
- No public proof of concept known
- Not listed in the CISA KEV catalog according to a secondary source (not verified)
- CISA SSVC: exploitation none, automatable no, technical impact total
- Related but distinct CVE-2026-73570 is reported as actively targeted by Microsoft
Our recommendation
- Inventory all Zimbra servers and record the exact ZCS version
- Check the Zimbra Security Advisories page for the fixed version and apply the patch as soon as it is published
- Until then, review sudoers entries for the zimbra account and monitor mailboxd for out-of-memory and restart events
- Restrict local shell access to the zimbra account and check CVE-2026-73570 status as well
- Assess the risk with the CVSS 7.8 score (local attack vector, full host impact)
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Zimbra Security Advisories wiki.zimbra.com
- Rapid7: From One Account to Every Mailbox (Part 1) www.rapid7.com
- VulDB CVE-2026-50056 vuldb.com
- NVD via Vulners CVE-2026-50056 vulners.com
- Microsoft: Unauthenticated command injection on mail servers (CVE-2026-73570) www.microsoft.com
- TheHackerWire CVE-2026-50056 www.thehackerwire.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 22:21.
Original description (NVD)
A local privilege escalation vulnerability in the zmmailboxdmgr launcher of Zimbra Collaboration Suite (ZCS) allows the Unix zimbra account to execute arbitrary commands as root. The passwordless sudo interface accepts JVM arguments that are not adequately restricted. An attacker can postpone Jetty's privilege drop, register an OnOutOfMemoryError command and force heap exhaustion during startup, causing the command to execute while the JVM still runs as root. Exploitation requires local command execution as zimbra on a mailbox server and interrupts mailboxd during the malicious restart. ZCS 10.1.16 and 10.1.21 are affected.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.