# CVE-2026-50056: Zimbra Collaboration Suite privilege escalation in zmmailboxdmgr

Source: https://junglewise.ai/threats/cve-2026-50056-a-local-privilege-escalation-vulnerability-in-the-zmmailboxdmgr  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-23. Updated: 2026-10-23  
License: CC BY 4.0 with a link back

CVE-2026-50056 · Severity: high · CVSS 7.8 · Published 2026-10-23

Zimbra Collaboration Suite is a self-hosted platform for enterprise email, calendars, and collaboration. A local privilege escalation flaw in the zmmailboxdmgr launcher allows the zimbra system account to execute arbitrary commands as root by manipulating JVM startup arguments and triggering out-of-memory conditions. An attacker with local access to the zimbra account can gain complete control over the mail server.

Technologies: [Zimbra Collaboration Suite](https://junglewise.ai/threats/technologies/collaboration). Vendors: [Zimbra](https://junglewise.ai/threats/vendors/zimbra).

## Quick answers

**Is CVE-2026-50056 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-50056 being exploited in the wild.

**How severe is CVE-2026-50056?** High severity, with a CVSS score of 7.8, published 23 October 2026.

**Which products and versions are affected?** Zimbra Collaboration Suite 10.1.16, 10.1.21.

**Is there a fix for CVE-2026-50056?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-50056 attacked?** It is attacked with local access, in a hosted service.

**Am I affected by CVE-2026-50056?** Check whether you run Zimbra Collaboration Suite at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The zmmailboxdmgr launcher accepts JVM arguments through a passwordless sudo interface without adequate filtering. An attacker can register an OnOutOfMemoryError command handler and force heap exhaustion during startup while the JVM still runs as root, before privilege dropping occurs. Exploitation requires prior local command execution as the zimbra user on a mailbox server and causes service interruption during the malicious restart.

## Affected products

- Zimbra Collaboration Suite 10.1.16, 10.1.21

## Timeline

- 2026-10-23: disclosed

## References

- [https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories](https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories)
- [https://www.rapid7.com/blog/post/ve-breaking-zimbra-identity-boundaries-part-1/](https://www.rapid7.com/blog/post/ve-breaking-zimbra-identity-boundaries-part-1/)

## Related threats

- [Zimbra Collaboration Suite local privilege escalation in dnscache](https://junglewise.ai/threats/cve-2026-93640-a-local-privilege-escalation-vulnerability-in-the-optional)
- [Zimbra Collaboration Suite authorization bypass in Zimlet configuration](https://junglewise.ai/threats/cve-2026-93639-a-missing-authorization-vulnerability-in-zimbra-collaboration)
- [Zimbra Collaboration Suite reflected cross-site scripting in login](https://junglewise.ai/threats/cve-2026-93638-a-reflected-cross-site-scripting-vulnerability-in-the-login-page)
- [Zimbra Collaboration Suite LDAP filter injection](https://junglewise.ai/threats/cve-2026-93636-an-ldap-filter-injection-vulnerability-in-zimbra-collaboration)
- [Zimbra Collaboration Suite cross-account authorization bypass in FileSharedWithMeRequest](https://junglewise.ai/threats/cve-2026-93634-a-cross-account-authorization-vulnerability-in-zimbra)