A local privilege escalation vulnerability in the Zimbra Collaboration Suite (ZCS) MTA package allows the Unix zimbra account to execute arbitrary… (CVE-2026-50057)

The vulnerability arises because the installed sudo policy allows the Unix zimbra account to run Postfix administration commands as root without password and without restricting command arguments. An attacker with local zimbra user privileges can configure a zimbra-controlled daemon_directory in Postfix and invoke the 'postfix set-permissions' command, which executes the attacker's post-install program as root. The Postfix configuration directory is writable by zimbra, so restricting only the 'postconf' command does not mitigate the issue. This flaw enables local privilege escalation from zimbra user to root on affected ZCS MTA nodes.

Successful exploitation allows an attacker with local access as the zimbra user to execute arbitrary commands with root privileges, leading to full system compromise. The vulnerability impacts confidentiality, integrity, and availability of the affected system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict local access to the zimbra user and carefully audit sudo policies related to Postfix administration commands to prevent unauthorized root command execution.