Zimbra Collaboration Suite: Local privilege escalation in zmmailboxdmgr (CVE-2026-50056)

CVE-2026-50056 is a local privilege escalation vulnerability in the zmmailboxdmgr utility within Zimbra Collaboration Suite (ZCS). The vulnerability originates from a passwordless sudo configuration that fails to restrict JVM arguments, allowing a low-privileged user (zimbra account) to inject malicious arguments. By forcing a heap exhaustion event during the JVM startup sequence, an attacker can execute arbitrary commands via the OnOutOfMemoryError handler while the process still maintains root privileges, prior to the intended privilege drop.

Impact

Successful exploitation allows a local user already operating as the zimbra account to escalate privileges to root on the affected mailbox server. This bypasses security controls designed to drop privileges during the startup of the Jetty web container.

Recommendation

1. Inventory all Zimbra Collaboration Suite mailbox server deployments to identify versions 10.1.16 and 10.1.21.
2. Prioritize patching or applying vendor-supplied mitigations for the affected versions immediately.
3. Until patched, monitor sudo logs and process creation patterns involving zmmailboxdmgr for unusual JVM arguments such as -XX:OnOutOfMemoryError.