Zimbra Collaboration Suite EUVD-2026-108981

Requires pre-existing local command execution as the Unix 'zimbra' account on a Zimbra MTA node (PR:L, AV:L). The condition is the default ZCS sudo policy that permits passwordless root execution of Postfix administration commands without restricting their arguments, combined with the Postfix configuration directory being writable by zimbra. Concretely, the attacker selects a zimbra-controlled daemon_directory in the Postfix configuration and invokes 'postfix set-permissions', which causes Postfix to run the attacker's post-install program as root; the description notes that restricting postconf alone does not remove this execution path. Limiting factors: no remote or unauthenticated path exists, exploitation is confined to MTA nodes running the affected ZCS MTA package, and an attacker must already hold zimbra-level execution - making this an escalation/chaining primitive rather than an initial-access vector.

This is a genuine, high-priority local privilege escalation rather than an inflated high-CVSS score, but its risk is gated by a real prerequisite. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.8) accurately frames it: exploitation is local, low-complexity, and requires existing low privileges - specifically code execution as the Unix 'zimbra' account - and yields full root compromise (C:H/I:H/A:H). The vuln.today decision label is 'this_week', consistent with a reliable local-to-root chain on widely deployed mail infrastructure. No CISA KEV listing and no EPSS score were provided, so there is no signal of active or widespread exploitation; EPSS absence is expected for a local-only PE flaw since EPSS models remote mass exploitation. The flaw was reported by Rapid7, whose public technical write-up describes the complete exploitation path, which materially raises practical risk even though the input does not mark a confirmed working exploit. The key limiting factor - needing an initial foothold as zimbra on an MTA node - means this is primarily a post-compromise escalation and chaining primitive (e.g., paired with a web/RCE bug in ZCS) rather than an internet-facing entry point. SSVC-style reasoning: technical impact is total (root), but exploitation is not shown as automatable and no active-exploitation signal is present, so prioritize for prompt patching without treating it as an active-incident emergency.

An attacker who has already obtained command execution as the zimbra service account on a Zimbra MTA node (for example via a prior web-application flaw or a stolen credential) abuses the overly permissive sudo policy. Because the Postfix config directory is zimbra-writable, the attacker sets a zimbra-controlled daemon_directory and runs the passwordless-sudo-permitted 'postfix set-permissions' command, causing Postfix to execute an attacker-supplied post-install program as root. Rapid7 has published a detailed technical analysis of this chain, though the input does not confirm packaged, verified working exploit code.