Zimbra Collaboration Suite: Local privilege escalation via dnscache sudo wrapper
Summary
The optional dnscache package of Zimbra Collaboration Suite (ZCS) contains a local privilege escalation flaw. The zimbra account can run zmunbound with arbitrary arguments via passwordless sudo, allowing it to read root-owned files, create or append to root-owned files and corrupt privileged configuration files. An attacker needs a shell as the zimbra account, so the flaw is mainly a follow-on risk after another compromise.
Affected
- Zimbra Collaboration Suite 10.1.16 and 10.1.21 with the optional dnscache package (CVE record: affected up to and including 10.1.21)
- Exact lower bound of the affected range: Unknown.
Fixed in
- Unknown. No fixed version confirmed in the sources reviewed.
Workaround
- Unknown. No vendor-confirmed workaround found.
- Verify whether the dnscache package is installed; if Unbound/dnscache is not needed, the exposure may not apply (confirm against the Zimbra advisory first).
Exploitation
- No public proof-of-concept exploit found at the time of writing.
- No evidence of exploitation in the wild found; not listed in the CISA KEV catalog according to one aggregator.
- CISA SSVC: Exploitation none, Automatable no, Technical Impact total.
Our recommendation
- Check whether the dnscache package is installed on each ZCS server.
- Restrict shell access as the zimbra account and review its sudo rules.
- Check ownership and permissions of Unbound/dnscache configuration and log files.
- Keep backups of configuration and key material.
- Apply the fix from the Zimbra Security Advisories as soon as it is published and confirmed for your version.
- Re-check the vendor advisory and exploitation status in the coming days.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Zimbra Security Advisories wiki.zimbra.com
- Rapid7: From One Account to Every Mailbox (Part 1) www.rapid7.com
- NVD record via Vulners vulners.com
- VulnRichment via Vulners vulners.com
- Strix CVE record www.strix.ai
- The Hacker Wire: CVE-2026-93640 www.thehackerwire.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 22:21.
Original description (NVD)
A local privilege escalation vulnerability in the optional dnscache package of Zimbra Collaboration Suite (ZCS) allows the Unix zimbra account to access files with root privileges. The passwordless sudo policy permits arbitrary arguments to zmunbound, whose wrapper forwards them to Unbound without restricting the configuration path. An attacker can supply a configuration that retains root privileges and disables the chroot. Include directives expose root-readable file contents through parser errors, while an attacker-selected logfile path creates a root-owned file or appends Unbound log records to an existing file. This can disclose password hashes and private keys and corrupt privileged configuration files, preventing affected services from starting with the modified configuration. The affected configuration is present in ZCS 10.1.16 and 10.1.21 dnscache packages.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.