PatchTheCVECVE-2026-93640: A local privilege escalation vulnerability in the optional dnscache package of Zimbra Collaboration Suite (ZCS
CVE-2026-93640 is a high-severity flaw (CVSS 7.8) affecting affected software. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
A local privilege escalation vulnerability in the optional dnscache package of Zimbra Collaboration Suite (ZCS) allows the Unix zimbra account to access files with root privileges. The passwordless sudo policy permits arbitrary arguments to zmunbound, whose wrapper forwards them to Unbound without restricting the configuration path. An attacker can supply a configuration that retains root privileges and disables the chroot. Include directives exp
Why this priority
- High severity
No fix is published yet: follow the downgrade or mitigation steps.
Risk facts
| CVSS score | 7.8 (High) |
| Attack vector | Local |
| Attack complexity | Low |
| Privileges needed | Low |
| User interaction | None |
| EPSS exploit chance | 0.1% (top 97%) |
| CISA exploited list | No |
| Weakness | CWE-732 |
| Published | 2026-10-23 |
| Last modified | 2026-10-24 |
Timeline
- Published CVE record published
- Updated Record last modified
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2026-93640?
No fixed release is listed yet. Watch the vendor advisory and apply any mitigation shown on this page.
Is CVE-2026-93640 being exploited?
CVE-2026-93640 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2026-93640 affect?
CVE-2026-93640 affects affected software. Severity is high (CVSS 7.8). A local privilege escalation vulnerability in the optional dnscache package of Zimbra Collaboration Suite (ZCS) allows the Unix zimbra account to access files with root privileges. The passwordless sudo policy permits arbitrary arguments to
How urgent is CVE-2026-93640?
Priority 28/100. High severity