Zimbra ZMMailboxDMgr local privilege escalation via Jetty OOM
CVE-2026-50056 Published on October 23, 2026
Zimbra Collaboration Suite Local Privilege Escalation via zmmailboxdmgr JVM Argument Injection
A local privilege escalation vulnerability in the zmmailboxdmgr launcher of Zimbra Collaboration Suite (ZCS) allows the Unix zimbra account to execute arbitrary commands as root. The passwordless sudo interface accepts JVM arguments that are not adequately restricted. An attacker can postpone Jetty's privilege drop, register an OnOutOfMemoryError command and force heap exhaustion during startup, causing the command to execute while the JVM still runs as root. Exploitation requires local command execution as zimbra on a mailbox server and interrupts mailboxd during the malicious restart. ZCS 10.1.16 and 10.1.21 are affected.
Vulnerability Analysis
CVE-2026-50056 is exploitable with local system access, and requires small amount of user privileges. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to be very high.
Weakness Type
What is an Argument Injection Vulnerability?
The software constructs a string for a command to executed by a separate component in another control sphere, but it does not properly delimit the intended arguments, options, or switches within that command string.
CVE-2026-50056 has been classified to as an Argument Injection vulnerability or weakness.
Products Associated with CVE-2026-50056
Want to know whenever a new CVE is published for Zimbra Collaboration Suite? stack.watch will email you.
Affected Versions
Zimbra Collaboration Suite:- Before and including 10.1.21 is affected.