Zimbra Collaboration Suite: Local privilege escalation to root via Postfix sudo rule
Summary
A flaw in the MTA package of Zimbra Collaboration Suite (ZCS) allows a local user running as the zimbra account to execute arbitrary commands as root. The sudo policy grants passwordless root execution of Postfix administration commands without restricting their arguments, so an attacker can point the daemon directory to a zimbra-controlled location and run postfix set-permissions to execute a program as root. Exploitation requires prior local command execution as zimbra on an MTA node.
Affected
- Zimbra Collaboration Suite 10.1.x, versions 0 to 10.1.21 according to the CNA record
- Explicitly named in the description: 10.1.16 and 10.1.21
- Lower bound of the affected range: Unclear
Fixed in
Unknown. The vendor's fixed-version list for CVE-2026-50057 could not be confirmed; do not assume 10.1.21 is fixed.
Workaround
- No vendor-documented workaround known.
- Restricting postconf alone is not sufficient, because the Postfix configuration directory is writable by zimbra.
Exploitation
- Public exploit: None known.
- Known exploited in the wild: No known exploitation.
- CISA SSVC: Exploitation none, Automatable no, Technical impact total.
Our recommendation
- Inventory all ZCS 10.1.x nodes and record their versions.
- Ask Zimbra support or check the Zimbra security advisories for the fixed release and apply it on a test node first, then in production.
- Until patched, review sudoers entries for zimbra on MTA nodes and remove passwordless rules for Postfix administration commands where ZCS support permits.
- Restrict local shell access to the zimbra account and check that Postfix configuration and daemon directories are not writable by zimbra.
- Monitor sudo logs for unexpected activity by the zimbra account.
- Patch the whole ZCS batch together, as other ZCS flaws in the same batch can be reached from outside.
- Priority: high for internet-facing servers, medium for internal servers with restricted shell access.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Zimbra Security Advisories wiki.zimbra.com
- Rapid7: From One Account to Every Mailbox (Part 1) www.rapid7.com
- VulDB CVE-2026-50057 vuldb.com
- NVD via Vulners CVE-2026-50057 vulners.com
- TheHackerWire CVE-2026-50057 www.thehackerwire.com
- Securityonline: Zimbra vulnerabilities (Rapid7) securityonline.info
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 22:22.
Original description (NVD)
A local privilege escalation vulnerability in the Zimbra Collaboration Suite (ZCS) MTA package allows the Unix zimbra account to execute arbitrary commands as root. The installed sudo policy permits passwordless root execution of Postfix administration commands without restricting their arguments. An attacker can select a zimbra-controlled daemon_directory in the Postfix configuration and invoke postfix set-permissions, causing Postfix to execute the attacker's post-install program as root. The Postfix configuration directory is also writable by zimbra, so restricting postconf alone does not remove the execution path. Exploitation requires local command execution as zimbra on an MTA node. ZCS 10.1.16 and 10.1.21 are affected.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.