CVE-2026-50057: Zimbra Collaboration Suite Local Privilege Escalation via Unrestricted Postfix Sudo Permissions
A local privilege escalation vulnerability in the Zimbra Collaboration Suite (ZCS) MTA package allows the Unix zimbra account to execute arbitrary commands as root. The installed sudo policy permits passwordless root execution of Postfix administration commands without restricting their arguments. An attacker can select a zimbra-controlled daemondirectory in the Postfix configuration and invoke postfix set-permissions, causing Postfix to execute the attacker's post-install program as root. The Postfix configuration directory is also writable by zimbra, so restricting postconf alone does not remove the execution path. Exploitation requires local command execution as zimbra on an MTA node. ZCS 10.1.16 and 10.1.21 are affected.
Affected Software
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Affected systems are Zimbra Collaboration Suite MTA nodes running ZCS 10.1.16 or 10.1.21. Exploitation requires local command execution as the Unix zimbra account, so systems where that account cannot be accessed or controlled by an attacker are not directly exploitable through this path.
Does an attacker need administrative access or user interaction to exploit it?
No user interaction is required, and the attacker does not need root access beforehand. They need the ability to run local commands as zimbra on an affected MTA node.
Why is limiting postconf insufficient as a mitigation?
The Postfix configuration directory is writable by zimbra. An attacker can set a zimbra-controlled daemon_directory in that configuration and then use postfix set-permissions to cause execution of an attacker-controlled post-install program as root.
What configuration should be reviewed if patching cannot happen immediately?
Review the sudo policy that allows passwordless root execution of Postfix administration commands, particularly whether command arguments are unrestricted. Also review whether the zimbra account can modify the Postfix configuration or set a daemon_directory that points to zimbra-controlled content.