Zammad CVE-2026-102489/102490: Exploited RCE-to-Root Chain

What to do

1. Find every self-hosted Zammad and its version and install type (dpkg -l zammad, rpm -q zammad, or the container image tag).
2. Upgrade to Zammad 7.2.2; if you are stuck on 6.5, install 6.5.5 today and plan the move to 7.2.2.
3. If you cannot upgrade a 6.x instance now, take it offline or put it behind a VPN, as DIVD advises.
4. Run DIVD's log check script for CVE-2026-102489 and preserve /var/log/zammad and the web server logs before rebuilding.
5. If you find signs of compromise, rebuild the host and rotate every credential Zammad stores or can reach, including mail, LDAP and API tokens.

How to check if you are affected or compromised

• Run DIVD's CVE-2026-102489 IoC check script (linked from case DIVD-2026-00015) against your Zammad and web server logs.
• Look for a session used from a new source address shortly after a login, and for requests that skip the normal login flow.
• Flag shells, download tools or new outbound connections spawned by Zammad's Rails, Puma or worker processes, and any process in that tree running as root.
• On DEB/RPM installs, look for files in the Zammad install directory changed by the zammad user outside of upgrades.

What happened#

On September 30, 2026, the Dutch Institute for Vulnerability Disclosure (DIVD) published two CVEs for the open-source Zammad helpdesk and said attackers had used them to breach DIVD itself. According to DIVD's case page, the chain was "abused to breach DIVD" on September 21 and reported to Zammad on September 24.

• CVE-2026-102489 is a session hijack (CISA tags it as session fixation) that leads to remote code execution as the zammad service user. It is rated CVSS 4.0 8.7 by DIVD, the CNA, and 9.8 on CVSS 3.1 by NVD.
• CVE-2026-102490 is a local privilege escalation from zammad to root. In the DEB and RPM packages, services started as root and ran files that the zammad account could write before dropping privileges. Because those services restart automatically, an attacker could escalate "within seconds." It is rated 8.5 alone and 9.4 when chained.

DIVD told BleepingComputer that after reaching root, the attacker accessed other services and exfiltrated data, and that an AI agent appeared to be choosing the next steps on its own. DIVD called the activity "loud and very, very messy." That is DIVD's assessment from observed behavior, and no actor has been named. CISA added both CVEs to the KEV catalog on October 2 (102489, 102490), with an October 5 deadline.

Who is affected#

The disclosure was messy, and the vendor and DIVD initially disagreed. On October 1, Zammad said it could not confirm the privilege escalation because DIVD had not shared details. Zammad later confirmed both. Where things stand now:

• RCE (CVE-2026-102489): exploitable on Zammad 6.3.0 through 6.5.4. It sits in the application itself, and the CVE record lists both Linux and Docker installs. The code is present in 7.0.0 through 7.1.x, but both Zammad and DIVD say it is not exploitable there because of the runtime environment. Zammad 7.2.0 added hardening. On October 15, Zammad shipped 6.5.5 as an emergency fix for the unsupported 6.5 series and said it "does not extend its support lifecycle."
• Root escalation (CVE-2026-102490): only DEB and RPM packages built with packager.io, from 1.5.0 through 7.2.1, are affected. Source installs and the official container images are not. The fix is 7.2.2, released October 8 with advisory GHSA-p97w-927q-8vxq. Zammad says SaaS customers need no action.

Do you really need to act?#

If you self-host Zammad 6.x, yes, today. The RCE needs no credentials, it has been used in a real intrusion, and DIVD is scanning for exposed instances. A helpdesk holds customer conversations, attachments and mail credentials, and it often sits inside the network. On a DEB or RPM install, the second bug turns that foothold into root on the host in seconds.

If you already run 7.x from packages, the remote entry point is closed, but the root escalation still matters. Any other bug or stolen credential that gives code execution as zammad becomes root. Upgrade to 7.2.2 this week. On 7.x via Docker or source, neither published bug applies. Stay current anyway, since Zammad shipped several other security releases in 2026.

What to do now#

1. Identify every instance and how it was installed: dpkg -l zammad or rpm -q zammad for packages, or the image tag in your compose file for Docker.
2. Upgrade to 7.2.2: apt-get update && apt-get install --only-upgrade zammad or dnf upgrade zammad. For Docker, set the 7.2.2 tag, then docker compose pull && docker compose up -d.
3. If a 6.5 instance cannot move to 7 today, install 6.5.5 now and schedule the 7.2.2 upgrade. If you cannot do either, take it offline as DIVD advises, or restrict it to a VPN.
4. Restrict shell access to the Zammad host to trusted administrators, as Zammad's advisory recommends.
5. If an exposed 6.x instance ran unpatched, rebuild the host and rotate the credentials Zammad stores, including mail accounts, LDAP binds, integrations and API tokens.

How to tell if you were hit#

DIVD publishes a log check script for CVE-2026-102489, linked from its case page. Preserve /var/log/zammad and your nginx or Apache logs before you run it, upgrade or rebuild. Sysdig suggests looking for a session reused from a new address shortly after login, and for requests that skip the normal login flow. Also flag shells, download tools or new outbound connections spawned by Zammad's Rails, Puma or worker processes, and any process in that tree running as root. On package installs, look for files in the Zammad install directory changed by the zammad user outside of upgrades. If you find any of these, assume root compromise of the host.

Timeline#

• Sep 21, 2026 — Attackers use the chain to breach DIVD.
• Sep 24, 2026 — DIVD reports the flaws to Zammad. It starts notifying owners of vulnerable instances on Sep 26.
• Sep 30, 2026 — The CVE records are published and DIVD discloses the breach.
• Oct 2, 2026 — CISA adds both CVEs to KEV.
• Oct 8, 2026 — Zammad 7.2.2 fixes the DEB/RPM root escalation.
• Oct 15, 2026 — Zammad 6.5.5 ships an emergency fix for CVE-2026-102489 on the 6.5 series.

Vulnerability records

• CVE-2026-102489 · KEV 2026-10-02 · Zammad versions 6.3.0 to 6.5.4 are vulnerable a session hijack vulnerability that leads to remote code execution as the zammad user.
• CVE-2026-102490 · KEV 2026-10-02 · Zammad packages built with packager.io (DEB and RPM) could have allowed a local attacker who already had file system write privileges as the unprivileged…

Sources

Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.

Original and primary sources

1. Zammad — Security Advisory: CVE-2026-102489 and CVE-2026-102490 zammad.com
2. Zammad / GitHub — GHSA-p97w-927q-8vxq: Local privilege escalation to root in DEB/RPM packages (packager.io) github.com
3. Zammad — Release 7.2.2 zammad.com
4. Zammad — Release 6.5.5 zammad.com
5. Zammad Community — Local privilege escalation CVE-2026-102490 is reported as being actively exploited community.zammad.org
6. DIVD — DIVD-2026-00015: Zammad vulnerabilities csirt.divd.nl
7. CVE record — CVE-2026-102489 cve.org
8. CVE record — CVE-2026-102490 cve.org
9. NVD — CVE-2026-102489 nvd.nist.gov
10. CISA — Known Exploited Vulnerabilities: CVE-2026-102489 cisa.gov
11. CISA — Known Exploited Vulnerabilities: CVE-2026-102490 cisa.gov
12. Sysdig — AI agent exploits Zammad zero-days in DIVD breach: what we know and how to detect it sysdig.com

Coverage and analysis

1. BleepingComputer — DIVD says Zammad zero-days enabled AI-driven network breach bleepingcomputer.com