A local privilege escalation vulnerability in the optional dnscache package of Zimbra Collaboration Suite (ZCS) allows the Unix zimbra account to… (CVE-2026-93640)

CVE-2026-93640 is a local privilege escalation vulnerability in the optional dnscache package of Zimbra Collaboration Suite (ZCS). The vulnerability arises because the Unix zimbra account has a passwordless sudo policy allowing arbitrary arguments to the zmunbound wrapper, which forwards these to the Unbound DNS resolver without restricting configuration file paths. An attacker can craft a configuration that disables chroot and retains root privileges, exposing root-readable files through parser errors and enabling creation or appending of root-owned log files. This can disclose sensitive information such as password hashes and private keys and corrupt configuration files, causing service startup failures. The affected versions are ZCS 10.1.16 and 10.1.21 dnscache packages. The CVSS 3.1 score is 7.8 (High), reflecting local attack vector with low complexity, no user interaction, and high impact on confidentiality, integrity, and availability.

Successful exploitation allows a local attacker with access to the Unix zimbra account to escalate privileges to root. This can lead to disclosure of sensitive data including password hashes and private keys, corruption of critical configuration files, and denial of service by preventing affected services from starting. The vulnerability compromises confidentiality, integrity, and availability of the affected system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the Unix zimbra account and review sudo policies to prevent arbitrary argument passing to zmunbound. Monitor for unauthorized configuration changes and avoid running the dnscache package if not necessary.