CVE-2026-50056: CWE-88 Improper neutralization of argument delimiters in a command ('argument injection') in Zimbra Zimbra Collaboration Suite

This vulnerability (CVE-2026-50056) in Zimbra Collaboration Suite arises from improper neutralization of argument delimiters (CWE-88) in the zmmailboxdmgr launcher. The passwordless sudo interface accepts JVM arguments without adequate restrictions, enabling an attacker with local zimbra user access to delay Jetty's privilege drop and register an OnOutOfMemoryError command. By causing heap exhaustion during JVM startup, the attacker can execute arbitrary commands as root. Exploitation requires local command execution as the zimbra user on a mailbox server and involves interrupting mailboxd during a malicious restart. Affected versions include all releases up to and including 10.1.21.

Successful exploitation results in local privilege escalation from the zimbra Unix account to root, allowing full system control. The vulnerability impacts confidentiality, integrity, and availability as indicated by the CVSS vector (C:H/I:H/A:H). No known exploits in the wild have been reported.

No patch or official fix information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict local access to the zimbra user account and monitor for suspicious activity related to mailboxd restarts. Avoid running untrusted code as the zimbra user.