Zimbra Collaboration Suite EUVD-2026-108979

Requires the attacker to already hold local command execution as the Unix 'zimbra' account on a Zimbra mailbox server. The flaw is reachable because the passwordless sudo interface to the zmmailboxdmgr launcher does not adequately restrict JVM arguments, allowing the attacker to postpone Jetty's privilege drop and register an OnOutOfMemoryError command that executes before the process drops from root. Limiting factors: no remote/network vector (local only), a pre-existing zimbra-level foothold is mandatory, exploitation is disruptive because it interrupts mailboxd during the malicious restart, and only affected ZCS builds (10.1.16 and 10.1.21, per EUVD ≤10.1.21) are vulnerable.

This is a genuine but access-gated privilege escalation, not a high-CVSS-but-low-real-risk paper vulnerability - yet its priority sits below internet-facing Zimbra flaws because it is local-only and requires a pre-existing foothold. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U, 7.8) is internally consistent with the description: exploitation needs local command execution as the unprivileged zimbra Unix account (PR:L) on a mailbox server, is low-complexity, and yields full root (C:H/I:H/A:H). The real risk is therefore chaining: an attacker who first lands code execution as zimbra (e.g. via a separate web/mailbox RCE or credential compromise) uses this to reach root. No EPSS score and no KEV listing were provided, so there is no evidence of widespread or active exploitation; the vuln.today decision label is 'this_week' (not act_now/emergency), aligning with a serious-but-not-fire-drill posture. A detailed public technical write-up from Rapid7 exists, which lowers the research bar for exploitation even though it is not confirmed as drop-in working exploit code. Net: patch on a prompt (this-week) cadence, prioritizing mailbox servers reachable by lower-privileged services, but this is a post-compromise escalation rather than an initial-access emergency.

An attacker who has already achieved command execution as the Unix 'zimbra' account (for example through a separate mailbox-server compromise) invokes the passwordless sudo zmmailboxdmgr launcher with crafted JVM arguments. They postpone Jetty's privilege drop, register an OnOutOfMemoryError command, and force heap exhaustion during startup so their command runs while the JVM is still root - yielding full root on the mailbox server. A public Rapid7 technical analysis describes the technique, though verified working exploit code is not confirmed in the provided data.