Zammad's Two Chained Flaws Hit CISA's Exploited List Before a Root Fix Was Named

A remote attacker who can get one Zammad user to interact with a crafted request can run code as the zammad system account on a self-hosted help desk running 6.3.0 through 6.5.4, according to the CVE record for CVE-2026-102489. A second flaw, CVE-2026-102490, then lets a local attacker on DEB and RPM installs climb from that account to root. CISA added both to its Known Exploited Vulnerabilities catalogue on October 2, with an October 5 deadline for federal agencies.

Zammad published its own advisory on October 5. It says 6.5 and earlier are the only versions where the remote bug is exploitable, that those versions are out of support and receive no security updates, and that a hardening change is in 7.2.0.

Timeline from the report to the CISA listing

• August 2026: Zammad says it first received and analysed the report on CVE-2026-102489 (Zammad advisory).
• September 24: DIVD reported the issues to Zammad, according to DIVD's timeline as Zammad describes it in its community post.
• September 26: DIVD published scanning results and disclosed the case publicly.
• September 29, 20:00 UTC: DIVD's case page for CVE-2026-102489 went live. The NVD record is dated September 30.
• October 1: Zammad posted a statement saying it had not verified exploitation, scope or affected versions.
• October 2: CISA added both CVEs to the catalogue.

The August and September dates do not reconcile in the sources. Zammad's advisory does not explain the gap.

The two flaws and their scores

CVE	Flaw	Scores	Affected
CVE-2026-102489	Session hijack leading to code execution as the zammad user (CWE-384)	CVSS 4.0: 8.7 alone, 9.4 chained; NVD 3.1: 9.8	6.3.0 to 6.5.4 per the CVE record
CVE-2026-102490	Local privilege escalation to root in DEB and RPM packages	CVSS 4.0: 8.5 alone, 9.4 chained; NVD 3.1: 7.8	1.5.0 up to 7.2.2 per the CVE record

The score overstates the remote bug in one respect. NVD's 3.1 vector of 9.8 drops the user-interaction requirement that the CNA's own 4.0 vector keeps (UI:P), and the 7.0.0 to 7.1.2 range contains the bug but is not exploitable because of framework changes, according to the record.

The score understates the second bug. The 7.8 rating treats it as local only, and Zammad agrees it "cannot be exploited remotely on its own." Chained behind the first flaw, the CNA scores the pair 9.4. The record says root-run services executed zammad-owned, writable files before dropping privileges, and automatic restarts made escalation possible within seconds. Source and container builds were not affected.

Where the sources disagree

DIVD says a chain of two zero-days in Zammad enabled a breach of its own network, according to Zammad's community post. Zammad says it has not verified that, and has asked DIVD for all available information. CISA's SSVC data in the CVE record marks exploitation as active.

The fix status is also unsettled. Zammad's October 5 advisory, as retrieved, named no patched release for CVE-2026-102490 and said the company was working on a solution. OpenCVE's record for the same CVE lists 7.2.2 as unaffected. Zammad's community post recommends 7.2.0, the current stable release, and does not name a patch for the root escalation.

The researchers credited on DIVD's page are from Merlon Security and DIVD. Zammad's advisory names neither.

What to do

Operators on 6.5 or older have no vendor patch coming and should move to a supported release. Everyone else should update to the newest 7.x and restrict the underlying server to trusted administrators, which is Zammad's own mitigation for the local flaw. The CVE record cites GitHub advisory GHSA-p97w-927q-8vxq for the packaging bug.

Zammad said in its October 5 advisory that it is working on a solution for CVE-2026-102490 and treating it as high priority. For comparison, see how the site covered CISA's October 8 additions and the NetScaler SAML flaw.