---
title: "Zammad CVE-2026-102489/102490: Exploited RCE-to-Root Chain"
url: https://erroneo.us/security/briefs/zammad-cve-2026-102489-102490-rce-root-chain/
description: "Zero-day chain used to breach DIVD: session hijack RCE in Zammad 6.3-6.5.4 plus root LPE in DEB/RPM installs. Upgrade to 7.2.2 (or 6.5.5) and hunt."
type: security-brief
section: "Security Digest"
date_published: 2026-09-30
date_modified: 2026-10-21
publisher: erroneo.us
author: erroneo.us Security Desk
verdict: "Act now"
cves: ["CVE-2026-102489", "CVE-2026-102490"]
severity: "critical"
exploited: "in-the-wild"
kev: true
license: All rights reserved. Quote with attribution and a link.
---

# Zammad CVE-2026-102489/102490: Exploited RCE-to-Root Chain

**Verdict: Act now.** Self-hosted Zammad on 6.x is remotely exploitable and was used in a real breach: upgrade to 7.2.2 today (6.5.5 only as a stopgap), and patch DEB/RPM installs of any version to close the root escalation.

- **Who must act:** Anyone self-hosting Zammad 6.3.0-6.5.4 (remote code execution), and anyone running Zammad from the DEB or RPM packages below 7.2.2 (local root escalation that completes the chain).
- **Who can relax:** Zammad SaaS customers, and self-hosted 7.x installs running from source or the official container images, which neither bug can be used against as published.
- **Affected:** Zammad 6.3.0 through 6.5.4 (CVE-2026-102489, exploitable); Zammad 7.0.0 through 7.1.x (CVE-2026-102489 code present but not exploitable per DIVD and Zammad); Zammad DEB/RPM packages 1.5.0 through 7.2.1 (CVE-2026-102490)
- **Fixed:** Zammad 7.2.2 (both issues); Zammad 7.2.0 (hardening for CVE-2026-102489); Zammad 6.5.5 (emergency CVE-2026-102489 fix for the unsupported 6.5 series)
- **CVEs:** CVE-2026-102489, CVE-2026-102490
- **CISA KEV:** yes · **Exploitation:** Exploited in the wild

## What to do

1. Find every self-hosted Zammad and its version and install type (dpkg -l zammad, rpm -q zammad, or the container image tag).
2. Upgrade to Zammad 7.2.2; if you are stuck on 6.5, install 6.5.5 today and plan the move to 7.2.2.
3. If you cannot upgrade a 6.x instance now, take it offline or put it behind a VPN, as DIVD advises.
4. Run DIVD's log check script for CVE-2026-102489 and preserve /var/log/zammad and the web server logs before rebuilding.
5. If you find signs of compromise, rebuild the host and rotate every credential Zammad stores or can reach, including mail, LDAP and API tokens.

### How to check if you are affected

- Run DIVD's CVE-2026-102489 IoC check script (linked from case DIVD-2026-00015) against your Zammad and web server logs.
- Look for a session used from a new source address shortly after a login, and for requests that skip the normal login flow.
- Flag shells, download tools or new outbound connections spawned by Zammad's Rails, Puma or worker processes, and any process in that tree running as root.
- On DEB/RPM installs, look for files in the Zammad install directory changed by the zammad user outside of upgrades.

## What happened

On September 30, 2026, the Dutch Institute for Vulnerability Disclosure (DIVD) published two CVEs for the open-source Zammad helpdesk and said attackers had used them to breach DIVD itself. According to [DIVD's case page](https://csirt.divd.nl/cases/DIVD-2026-00015/), the chain was "abused to breach DIVD" on September 21 and reported to Zammad on September 24.

- [CVE-2026-102489](https://www.cve.org/CVERecord?id=CVE-2026-102489) is a session hijack (CISA tags it as session fixation) that leads to remote code execution as the `zammad` service user. It is rated CVSS 4.0 8.7 by DIVD, the CNA, and 9.8 on CVSS 3.1 by [NVD](https://nvd.nist.gov/vuln/detail/CVE-2026-102489).
- [CVE-2026-102490](https://www.cve.org/CVERecord?id=CVE-2026-102490) is a local privilege escalation from `zammad` to root. In the DEB and RPM packages, services started as root and ran files that the `zammad` account could write before dropping privileges. Because those services restart automatically, an attacker could escalate "within seconds." It is rated 8.5 alone and 9.4 when chained.

DIVD told [BleepingComputer](https://www.bleepingcomputer.com/news/security/divd-says-zammad-zero-days-enabled-ai-driven-network-breach/) that after reaching root, the attacker accessed other services and exfiltrated data, and that an AI agent appeared to be choosing the next steps on its own. DIVD called the activity "loud and very, very messy." That is DIVD's assessment from observed behavior, and no actor has been named. CISA added both CVEs to the KEV catalog on October 2 ([102489](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-102489), [102490](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-102490)), with an October 5 deadline.

## Who is affected

The disclosure was messy, and the vendor and DIVD initially disagreed. On October 1, Zammad [said](https://community.zammad.org/t/take-care-local-privilege-escalation-cve-2026-102490-is-reported-as-being-actively-exploited/21297/2) it could not confirm the privilege escalation because DIVD had not shared details. Zammad later confirmed both. Where things stand now:

- **RCE (CVE-2026-102489):** exploitable on Zammad 6.3.0 through 6.5.4. It sits in the application itself, and the CVE record lists both Linux and Docker installs. The code is present in 7.0.0 through 7.1.x, but both Zammad and DIVD say it is not exploitable there because of the runtime environment. Zammad 7.2.0 added hardening. On October 15, Zammad shipped [6.5.5](https://zammad.com/en/releases/6-5-5) as an emergency fix for the unsupported 6.5 series and said it "does not extend its support lifecycle."
- **Root escalation (CVE-2026-102490):** only DEB and RPM packages built with packager.io, from 1.5.0 through 7.2.1, are affected. Source installs and the official container images are not. The fix is [7.2.2](https://zammad.com/en/releases/7-2-2), released October 8 with advisory [GHSA-p97w-927q-8vxq](https://github.com/zammad/zammad/security/advisories/GHSA-p97w-927q-8vxq). Zammad says SaaS customers need no action.

## Do you really need to act?

If you self-host Zammad 6.x, yes, today. The RCE needs no credentials, it has been used in a real intrusion, and DIVD is scanning for exposed instances. A helpdesk holds customer conversations, attachments and mail credentials, and it often sits inside the network. On a DEB or RPM install, the second bug turns that foothold into root on the host in seconds.

If you already run 7.x from packages, the remote entry point is closed, but the root escalation still matters. Any other bug or stolen credential that gives code execution as `zammad` becomes root. Upgrade to 7.2.2 this week. On 7.x via Docker or source, neither published bug applies. Stay current anyway, since Zammad shipped several other security releases in 2026.

## What to do now

1. Identify every instance and how it was installed: `dpkg -l zammad` or `rpm -q zammad` for packages, or the image tag in your compose file for Docker.
2. Upgrade to 7.2.2: `apt-get update && apt-get install --only-upgrade zammad` or `dnf upgrade zammad`. For Docker, set the 7.2.2 tag, then `docker compose pull && docker compose up -d`.
3. If a 6.5 instance cannot move to 7 today, install 6.5.5 now and schedule the 7.2.2 upgrade. If you cannot do either, take it offline as DIVD advises, or restrict it to a VPN.
4. Restrict shell access to the Zammad host to trusted administrators, as Zammad's [advisory](https://zammad.com/en/advisories/cve-2026-102489-cve-2026-102490) recommends.
5. If an exposed 6.x instance ran unpatched, rebuild the host and rotate the credentials Zammad stores, including mail accounts, LDAP binds, integrations and API tokens.

## How to tell if you were hit

DIVD publishes a log check script for CVE-2026-102489, linked from its case page. Preserve `/var/log/zammad` and your nginx or Apache logs before you run it, upgrade or rebuild. [Sysdig](https://www.sysdig.com/blog/ai-agent-exploits-zammad-zero-days-in-divd-breach-what-we-know-and-how-to-detect-it) suggests looking for a session reused from a new address shortly after login, and for requests that skip the normal login flow. Also flag shells, download tools or new outbound connections spawned by Zammad's Rails, Puma or worker processes, and any process in that tree running as root. On package installs, look for files in the Zammad install directory changed by the `zammad` user outside of upgrades. If you find any of these, assume root compromise of the host.

## Timeline

- Sep 21, 2026 — Attackers use the chain to breach DIVD.
- Sep 24, 2026 — DIVD reports the flaws to Zammad. It starts notifying owners of vulnerable instances on Sep 26.
- Sep 30, 2026 — The CVE records are published and DIVD discloses the breach.
- Oct 2, 2026 — CISA adds both CVEs to KEV.
- Oct 8, 2026 — Zammad 7.2.2 fixes the DEB/RPM root escalation.
- Oct 15, 2026 — Zammad 6.5.5 ships an emergency fix for CVE-2026-102489 on the 6.5 series.

## Sources

1. [Zammad — Security Advisory: CVE-2026-102489 and CVE-2026-102490](https://zammad.com/en/advisories/cve-2026-102489-cve-2026-102490)
2. [Zammad / GitHub — GHSA-p97w-927q-8vxq: Local privilege escalation to root in DEB/RPM packages (packager.io)](https://github.com/zammad/zammad/security/advisories/GHSA-p97w-927q-8vxq)
3. [Zammad — Release 7.2.2](https://zammad.com/en/releases/7-2-2)
4. [Zammad — Release 6.5.5](https://zammad.com/en/releases/6-5-5)
5. [Zammad Community — Local privilege escalation CVE-2026-102490 is reported as being actively exploited](https://community.zammad.org/t/take-care-local-privilege-escalation-cve-2026-102490-is-reported-as-being-actively-exploited/21297/2)
6. [DIVD — DIVD-2026-00015: Zammad vulnerabilities](https://csirt.divd.nl/cases/DIVD-2026-00015/)
7. [CVE record — CVE-2026-102489](https://www.cve.org/CVERecord?id=CVE-2026-102489)
8. [CVE record — CVE-2026-102490](https://www.cve.org/CVERecord?id=CVE-2026-102490)
9. [NVD — CVE-2026-102489](https://nvd.nist.gov/vuln/detail/CVE-2026-102489)
10. [CISA — Known Exploited Vulnerabilities: CVE-2026-102489](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-102489)
11. [CISA — Known Exploited Vulnerabilities: CVE-2026-102490](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-102490)
12. [Sysdig — AI agent exploits Zammad zero-days in DIVD breach: what we know and how to detect it](https://www.sysdig.com/blog/ai-agent-exploits-zammad-zero-days-in-divd-breach-what-we-know-and-how-to-detect-it)
13. [BleepingComputer — DIVD says Zammad zero-days enabled AI-driven network breach](https://www.bleepingcomputer.com/news/security/divd-says-zammad-zero-days-enabled-ai-driven-network-breach/)

---
Source page: https://erroneo.us/security/briefs/zammad-cve-2026-102489-102490-rce-root-chain/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt