CVE-2026-50056: fallo de gravedad alta en Zimbra Collaboration Suite
Zimbra Collaboration Suite Local Privilege Escalation via zmmailboxdmgr JVM Argument Injection
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
21Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 7.8epss 0.3%
A local privilege escalation vulnerability in the zmmailboxdmgr launcher of Zimbra Collaboration Suite (ZCS) allows the Unix zimbra account to execute arbitrary commands as root. The passwordless sudo interface accepts JVM arguments that are not adequately restricted. An attacker can postpone Jetty's privilege drop, register an OnOutOfMemoryError command and force heap exhaustion during startup, causing the command to execute while the JVM still runs as root. Exploitation requires local command execution as zimbra on a mailbox server and interrupts mailboxd during the malicious restart. ZCS 10.1.16 and 10.1.21 are affected.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Productos afectados
Zimbra · Zimbra Collaboration SuiteCVEs relacionadas — Zimbra Collaboration Suite
En el mismo producto, de las más peligrosas a las menos.
CVE-2026-115785MEDIUMZimbra Collaboration Suite Data Source Test SMTP Command Injection via Unsanitized Email AddressEPSS 0.7%CVE-2026-93639HIGHZimbra Collaboration Suite Missing Authorization in ConfigureZimlet Enables Delegated Administrator Privilege EscalationEPSS 0.4%CVE-2026-115786MEDIUMZimbra Collaboration Suite Shared-File Mailbox Quota Accounting Error Enables Quota ExhaustionEPSS 0.4%CVE-2026-50055MEDIUMZimbra Collaboration Suite Sieve Notify Filter Action Bypasses Mail Forwarding Restriction via Variable ExpansionEPSS 0.4%CVE-2026-93636MEDIUMZimbra Collaboration Suite LDAP Filter Injection via Calendar Resource Attribute NameEPSS 0.3%CVE-2026-93637LOWZimbra Collaboration Suite GraphQL Batched Authentication Bypasses Pre-Auth Rate LimitingEPSS 0.3%