CVE-2026-50057
HIGH 7.8A local privilege escalation vulnerability in the Zimbra Collaboration Suite (ZCS) MTA package allows the Unix zimbra account to execute arbitrary commands as root. The installed sudo policy permits passwordless root execution of Postfix administration commands without restricting their arguments. An attacker can select a zimbra-controlled daemon_directory in the Postfix configuration and invoke postfix set-permissions, causing Postfix to execute the attacker's post-install program as root. The Postfix configuration directory is also writable by zimbra, so restricting postconf alone does not remove the execution path. Exploitation requires local command execution as zimbra on an MTA node. ZCS 10.1.16 and 10.1.21 are affected.
Severe if exploited (CVSS 7.8), but no known exploitation and low modeled probability. Patch on a normal cadence.
Exploitation likelihood
0.3%chance of exploitation in 30 days · 19th percentile
Impact if exploited
7.8CVSS 3.1 · HIGH
- ConfidentialityHigh
- IntegrityHigh
- AvailabilityHigh
What an attacker needs
- ⚠Access: Requires local access to the host
- ⚠Privileges: Requires a low-privilege account
- ✓User interaction: No user interaction needed
- ✓Complexity: No special conditions — reliably repeatable
✓ lowers the bar for an attacker · ⚠ raises it
Proof of concept
No public PoC is currently catalogued.
Search for new PoCs
Search GitHub now — results may be empty or unverified.
Tracked sources are checked daily for recent CVEs, including PoCs published after the original disclosure. A later release appears after a tracked source lists it and a refresh succeeds.
Data snapshot:
Weakness (CWE)
- CWE-732: Incorrect Permission Assignment for Critical Resource
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References and research data (JSON)
All CVSS metrics
- HIGH 7.8 v3.1 · CNA Primary
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - HIGH 7.8 v3.1 · NVD Secondary
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References
Advisories
- https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories CVE record · rapid7 · Updated 2026-10-23T13:33:29.682Z
NVD · CVE-2026-50057 · Updated 2026-10-24T04:18:18.110 - https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-108981 EUVD · EUVD-2026-108981
Technical & other
- https://www.rapid7.com/blog/post/ve-breaking-zimbra-identity-boundaries-part-1/ CVE record · rapid7 · Updated 2026-10-23T13:33:29.682Z
NVD · CVE-2026-50057 · Updated 2026-10-24T04:18:18.110