Is CVE-2026-50056 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-50056 being exploited in the wild.

How severe is CVE-2026-50056?

High severity, with a CVSS score of 7.8, published 23 October 2026.

Which products and versions are affected?

Zimbra Collaboration Suite 10.1.16, 10.1.21.

Is there a fix for CVE-2026-50056?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-50056 attacked?

It is attacked with local access, in a hosted service.

Am I affected by CVE-2026-50056?

Check whether you run Zimbra Collaboration Suite at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-50056: Zimbra Collaboration Suite privilege escalation in zmmailboxdmgr

CVE-2026-50056 · Severity: high · CVSS 7.8 · Published 2026-10-23

Zimbra Collaboration Suite is a self-hosted platform for enterprise email, calendars, and collaboration. A local privilege escalation flaw in the zmmailboxdmgr launcher allows the zimbra system account to execute arbitrary commands as root by manipulating JVM startup arguments and triggering out-of-memory conditions. An attacker with local access to the zimbra account can gain complete control over the mail server.

Technologies: Zimbra Collaboration Suite. Vendors: Zimbra.

Quick answers

Is CVE-2026-50056 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-50056 being exploited in the wild.
How severe is CVE-2026-50056?: High severity, with a CVSS score of 7.8, published 23 October 2026.
Which products and versions are affected?: Zimbra Collaboration Suite 10.1.16, 10.1.21.
Is there a fix for CVE-2026-50056?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-50056 attacked?: It is attacked with local access, in a hosted service.
Am I affected by CVE-2026-50056?: Check whether you run Zimbra Collaboration Suite at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The zmmailboxdmgr launcher accepts JVM arguments through a passwordless sudo interface without adequate filtering. An attacker can register an OnOutOfMemoryError command handler and force heap exhaustion during startup while the JVM still runs as root, before privilege dropping occurs. Exploitation requires prior local command execution as the zimbra user on a mailbox server and causes service interruption during the malicious restart.

Affected products

Zimbra Collaboration Suite 10.1.16, 10.1.21

Timeline

2026-10-23: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.