Local Privilege Escalation in Zimbra Collaboration Suite dnscache Package

CVE-2026-93640

What is CVE-2026-93640?

A local privilege escalation vulnerability exists in the optional dnscache package of Zimbra Collaboration Suite, impacting Unix-based systems. This vulnerability allows the zimbra account to access sensitive files with root privileges due to an improper passwordless sudo setup. By exploiting arbitrary arguments to zmunbound, an attacker can craft configurations that leak root-readable file contents and create or modify root-owned log files. This can lead to the disclosure of critical information such as password hashes and private keys, as well as corrupt vital configuration files, preventing those services from operating correctly. Affected versions include ZCS 10.1.16 and 10.1.21.

References