zammad

Zammad session-hijack RCE and root escalation are under active exploitation

Two critical Zammad CVEs (9.4 CVSS 4.0) are in the CISA KEV catalog, and one was used to breach a Dutch government agency on 21 Sep 2026. Upgrade to the fixed release or take the instance offline.

Glenn Fryklund

Glenn Fryklund

— 2 min read
Share
Abstract cybersecurity illustration of a cracked shield with data streams and a key escalating through privilege rings.
Zammad session-hijack RCE and root privilege escalation under active exploitation.

Two critical Zammad vulnerabilities, both scored 9.4 under CVSS 4.0, are in the CISA Known Exploited Vulnerabilities catalog, and one was used to breach a Dutch government agency. If you run Zammad, the remediation window has already closed.

The pair

CVE-2026-102489 is a session fixation flaw (CWE-384) that leads to remote code execution as the zammad user. It affects versions 6.3.0 through 6.5.4. The same bug is present in 7.0.0 through 7.1.3, but is not exploitable in those releases due to environment conditions. CVE-2026-102490 is a separate privilege-management flaw (CWE-269): the local zammad user can escalate to root. DIVD lists the affected range as v1.5.0 through v7.1.0-alpha.

Both CVEs were added to KEV on 2026-10-02 with a remediation due date of 2026-10-05.

What happened in the wild

DIVD's CSIRT case DIVD-2026-00015 records that the vulnerability was abused to breach DIVD on 21 Sep 2026. The agency reported the issue to Zammad on 24 Sep 2026. DIVD is actively scanning for vulnerable instances and alerting their owners. The NVD records and the vendor's GitHub security advisories were published on 2026-09-30.

Keep the dates apart. The breach happened on 21 Sep, disclosure to the vendor on 24 Sep, public publication on 30 Sep, and the KEV listing on 2 Oct. The in-the-wild abuse predates the public disclosure by a week.

On ransomware: the KEV entry lists knownRansomwareCampaignUse as Unknown for both CVEs. There is no confirmed ransomware campaign, and nothing here claims one.

The fix

Zammad released 7.2.1 on 2026-10-06 as a security release addressing a set of GitHub security advisories. The release notes do not name CVE-2026-102489 or CVE-2026-102490 by ID, and the published GHSA advisories carry no first-patched-version field. The vendor fix mapping is therefore unconfirmed by a published advisory. The upgrade guidance below comes from DIVD, not the vendor.

DIVD's recommendation, last modified 01 Oct 2026, is to upgrade to Zammad 7 or take the instance offline. There is no workaround. Patch status is marked Available.

If you run Zammad

  • Identify your version. Anything in 6.3.0 to 6.5.4 is exposed to the RCE. The local-to-root path (CVE-2026-102490) spans a much wider range, v1.5.0 to v7.1.0-alpha.
  • If you are on 7.0.0 to 7.1.3, the RCE is present but not exploitable due to environment conditions. Treat it as lower urgency, but do not skip the LPE check.
  • Upgrade to the fixed release, or take the instance offline if you cannot patch now.
  • Check your logs for the session-fixation indicator and for local privilege escalation from the zammad account.

Sources

Transparency note: This article was AI/LLM-assisted. It was drafted with language model support and reviewed by a human before publication. See How we use AI for the full workflow.
Topics:

Read more