{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3azimbracollaboration_suite10.1.21/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:zimbra:collaboration_suite:10.1.16:*:*:*:*:*:*:*","cpe:2.3:a:zimbra:collaboration_suite:10.1.21:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.8,"id":"CVE-2026-50056"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Zimbra Collaboration Suite (10.1.16, 10.1.21)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["Zimbra"],"content_html":"\u003cp\u003eCVE-2026-50056 is a local privilege escalation vulnerability in the \u003ccode\u003ezmmailboxdmgr\u003c/code\u003e utility within Zimbra Collaboration Suite (ZCS). The vulnerability originates from a passwordless sudo configuration that fails to restrict JVM arguments, allowing a low-privileged user (zimbra account) to inject malicious arguments. By forcing a heap exhaustion event during the JVM startup sequence, an attacker can execute arbitrary commands via the \u003ccode\u003eOnOutOfMemoryError\u003c/code\u003e handler while the process still maintains root privileges, prior to the intended privilege drop.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows a local user already operating as the zimbra account to escalate privileges to root on the affected mailbox server. This bypasses security controls designed to drop privileges during the startup of the Jetty web container.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eInventory all Zimbra Collaboration Suite mailbox server deployments to identify versions 10.1.16 and 10.1.21.\u003c/li\u003e\n\u003cli\u003ePrioritize patching or applying vendor-supplied mitigations for the affected versions immediately.\u003c/li\u003e\n\u003cli\u003eUntil patched, monitor sudo logs and process creation patterns involving \u003ccode\u003ezmmailboxdmgr\u003c/code\u003e for unusual JVM arguments such as \u003ccode\u003e-XX:OnOutOfMemoryError\u003c/code\u003e.\u003c/li\u003e\n\u003c/ol\u003e\n","date_modified":"2026-10-23T15:07:55Z","date_published":"2026-10-23T15:07:55Z","id":"https://feed.craftedsignal.io/briefs/2026-10-zimbra-lpe/","summary":"A local privilege escalation vulnerability in the Zimbra Collaboration Suite zmmailboxdmgr launcher allows the zimbra user to execute arbitrary commands as root via improper JVM argument validation in sudo.","title":"Zimbra Collaboration Suite: Local privilege escalation in zmmailboxdmgr (CVE-2026-50056)","url":"https://feed.craftedsignal.io/briefs/2026-10-zimbra-lpe/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:zimbra:collaboration_suite:10.1.21:*:*:*:*:*:*:*","version":"https://jsonfeed.org/version/1.1"}