---
cve: "CVE-2026-50056"
severity: "HIGH"
cvss: 7.8
epss: "0.3%"
vendor: "Zimbra"
kev: false
exploited: false
published: "2026-10-23 14:17:53"
tags: [cve, security, high]
source: tsecurity.de CVE-Dossier
exported: "2026-11-08T22:37:15+01:00"
---

# CVE-2026-50056

> 7.8 HIGH

## Beschreibung

A local privilege escalation vulnerability in the zmmailboxdmgr launcher of Zimbra Collaboration Suite (ZCS) allows the Unix zimbra account to execute arbitrary commands as root. The passwordless sudo interface accepts JVM arguments that are not adequately restricted. An attacker can postpone Jetty's privilege drop, register an OnOutOfMemoryError command and force heap exhaustion during startup, causing the command to execute while the JVM still runs as root. Exploitation requires local command execution as zimbra on a mailbox server and interrupts mailboxd during the malicious restart. ZCS 10.1.16 and 10.1.21 are affected.

## CNA-Record (Kanon, cvelistV5)

- CNA: **rapid7**
- State: PUBLISHED
- Stand: 2026-10-29 10:45:48
- CNA-CVSS: **7.8** (`CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H`)

## CISA-Anreicherung (vulnrichment/ADP)

- CISA-SSVC (Coordinator, v2.0.3):
  - Exploitation: **none**
  - Automatable: **no**
  - Technical Impact: **total**

## CVSS-Vektor

```
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
```

| Metrik | Wert | Bewertung |
|---|---|---|
| AV Angriffsvektor | Lokal | good |
| AC Komplexität | Gering | bad |
| PR Privilegien | Gering | warn |
| UI Interaktion | Keine | bad |
| S Scope | Unverändert | good |
| C Vertraulichkeit | Hoch | bad |
| I Integrität | Hoch | bad |
| A Verfügbarkeit | Hoch | bad |

## Schwachstellen-Klasse

- **CWE-88** — Improper Neutralization of Argument Delimiters in a Command
  The product constructs a string for a command to be executed by a separate component in another control sphere, but it does not properly delimit the intended arguments, options, or switches within that command string.

## Angriffsmuster (CAPEC)

- [CAPEC-41 — Using Meta-characters in E-mail Headers to Inject Malicious Payloads](https://capec.mitre.org/data/definitions/41.html) _(Severity: High)_
- [CAPEC-88 — OS Command Injection](https://capec.mitre.org/data/definitions/88.html) _(Severity: High)_
- [CAPEC-137 — Parameter Injection](https://capec.mitre.org/data/definitions/137.html) _(Severity: Medium)_
- [CAPEC-174 — Flash Parameter Injection](https://capec.mitre.org/data/definitions/174.html) _(Severity: Medium)_
- [CAPEC-460 — HTTP Parameter Pollution (HPP)](https://capec.mitre.org/data/definitions/460.html) _(Severity: Medium)_

## BSI-Hinweise (deutsch)

- [Synacor Zimbra Collaboration Suite: Mehrere Schwachstellen](https://wid.cert-bund.de/portal/wid/sicherheitshinweis/WID-SEC-W-2026-4144) — _BSI-Einstufung: hoch_
  Ein Angreifer kann mehrere Schwachstellen in Synacor Zimbra ausnutzen, um sich erweiterte Berechtigungen – einschließlich Root-Rechte – zu verschaffen, Sicherheitsmaßnahmen zu umgehen, Spoofing- und Cross-Site-Scripting-Angriffe durchzuführen, sensible Daten zu manipulieren oder offenzulegen oder einen Denial-of-Service-Zustand auszulösen.

## Referenzen

- <https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories>
- <https://www.rapid7.com/blog/post/ve-breaking-zimbra-identity-boundaries-part-1/>

---
_Exportiert aus dem [tsecurity.de CVE-Dossier](https://tsecurity.de/sicherheitsluecken/cve-2026-50056/) · Datenquellen: EUVD (ENISA), NVD, OSV, CISA KEV, FIRST EPSS, Exploit-DB, BSI WID (CSAF)_