KEV catalog · CISA Known Exploited Vulnerabilities
CVE-2026-102490
3-Day Required
KEV
Active Exploitation
Details
VulnerabilityZammad GmbH Zammad Improper Privilege Management Vulnerability
VendorZammad GmbH
ProductZammad
Date added2026-10-02
Due date2026-10-05
CISA catalogView on CISA KEV catalog
Required actionApply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
CWECWE-269
Descriptions
KEV: Zammad GmbH Zammad contains an improper privilege management vulnerability that can allow the local zammad user to escalate privileges to root. This vulnerability can be chained with CVE-2026-102489.
NVD: All versions of Zammad including the latest alpha enable the local zammad user to escalate privileges to root.
Compliance SSVC + BOD 26-04
Automatableno
Technical impacttotal
Exploitation statusactive
3-day qualifyingYes
Public timeline3 days + forensic
Non-public timeline14 days
Forensic (public)Required
Forensic (non-public)Not required
Research metadata
Last researched2026-10-02 17:00 UTC
Wall time0.7s
Searches20
Component defaultyes - every package and Docker install creates the `zammad` system user and runs all Zammad services as it (systemd zammad.service/zammad-web.service/zammad-worker.service/zammad-websocket.service all set User=zammad)
Sources
https://csirt.divd.nl/CVE-2026-102490
https://csirt.divd.nl/DIVD-2026-00015
https://csirt.divd.nl/cases/DIVD-2026-00014/
https://csirt.divd.nl/downloads/DIVD-2026-00015/cve-2026-102489_ioc_check_script_v2.sh
https://advisories.ncsc.nl/2026/ncsc-2026-0396.html
https://www.ncsc.nl/alerts/actief-misbruik-van-zeroday-kwetsbaarheden-in-zammad-update-nu
https://www.helpnetsecurity.com/2026/10/01/divd-agentic-ai-attack-breach/
https://www.securityweek.com/zammad-zero-days-exploited-in-ai-powered-divd-hack/
https://github.com/advisories/GHSA-hgff-g8g3-4xr8
https://github.com/alan-turing-institute/cyber-threat-observatory/blob/main/reports/2026-09-30/TIER_3_CVE-2026-102490.md
https://zammad.com/en/advisories
https://zammad.com/en/product/releases
https://github.com/zammad/zammad/blob/master/script/systemd/zammad-web.service
https://docs.zammad.org/en/latest/install/package.html
https://csirt.divd.nl/DIVD-2026-00015
https://csirt.divd.nl/cases/DIVD-2026-00014/
https://csirt.divd.nl/downloads/DIVD-2026-00015/cve-2026-102489_ioc_check_script_v2.sh
https://advisories.ncsc.nl/2026/ncsc-2026-0396.html
https://www.ncsc.nl/alerts/actief-misbruik-van-zeroday-kwetsbaarheden-in-zammad-update-nu
https://www.helpnetsecurity.com/2026/10/01/divd-agentic-ai-attack-breach/
https://www.securityweek.com/zammad-zero-days-exploited-in-ai-powered-divd-hack/
https://github.com/advisories/GHSA-hgff-g8g3-4xr8
https://github.com/alan-turing-institute/cyber-threat-observatory/blob/main/reports/2026-09-30/TIER_3_CVE-2026-102490.md
https://zammad.com/en/advisories
https://zammad.com/en/product/releases
https://github.com/zammad/zammad/blob/master/script/systemd/zammad-web.service
https://docs.zammad.org/en/latest/install/package.html
Hunting hypothesis agent
Hunt Linux auth/audit logs for the `zammad` service account invoking sudo, su, or setuid helpers and spawning root shells during CVE-2026-102490 local escalation; flag root-owned files created under /opt/zammad by zammad-user processes.
Research details
Componentlocal `zammad` service account privilege boundary (systemd units run User=zammad; package/Docker installs on Linux) - LPE to root, mechanism undisclosed
PreconditionsRequires an existing local session as the `zammad` OS service account (low privilege, no user interaction; CVSS v4 standalone AV:L/AC:L/PR:L/UI:N) - the account every package/Docker install runs Zammad services as. Affects Zammad 1.5.0 through 7.1.0-alpha per DIVD (versions before 1.5.0 unknown; NVD/DIVD description says all versions including the latest alpha); Linux and Docker platforms. No fix confirmed for this CVE as of 2026-10-02 (NCSC-NL: second zero-day unpatched, Zammad shipped an update only for CVE-2026-102489). Typically reached remotely by first chaining CVE-2026-102489 (unauth session hijack RCE as the zammad user). agent
Deliverylocal privilege escalation from the zammad OS service account, typically chained after CVE-2026-102489 network RCE as the zammad user
Public PoCno
Exploit notesNo public weaponized exploit: GitHub code, repository and issue searches for the CVE return only CVE datasets, news and tracking pages, and no Exploit-DB/Metasploit/Nuclei artifact exists; the Alan Turing Institute cyber-threat-observatory assessment confirms no public PoC. DIVD's only artifact (cve-2026-102489_ioc_check_script_v2.sh) is detection tooling that greps Zammad Rails/nginx logs for leaked session material from the chained CVE-2026-102489, not exploit code. Standalone exploitation is local-only (CVSS:4.0 base 8.5, AV:L/PR:L/UI:N, E:A) and needs a zammad-user foothold; chained with CVE-2026-102489 it becomes network-reachable with no privileges (base 9.4). Actively exploited against DIVD since 2026-09-21 in an agentic-AI attack (zammad user to root in seconds); root cause remains undisclosed and NCSC-NL reported the flaw unpatched as of 2026-09-30.
SummaryImproper privilege management (CWE-269) lets the local `zammad` service account escalate to root on Zammad hosts; DIVD lists affected versions 1.5.0 through 7.1.0-alpha (NVD: all versions including the latest alpha) and scores it 8.5 standalone (AV:L) and 9.4 when chained with CVE-2026-102489 (AV:N). It was exploited in the agentic-AI breach of DIVD's own helpdesk on 2026-09-21, chaining session hijack to RCE as the zammad user and on to root in seconds; CISA added it to KEV on 2026-10-02 (due 2026-10-05). No public exploit exists and Zammad has posted no CVE-specific vendor advisory yet (advisories moved to GitHub; none covers this CVE), so DIVD's coordinated advisory is the reference - DIVD advises upgrading to Zammad 7 or taking instances offline, and NCSC-NL says this second flaw was still unpatched while Zammad shipped a fix for CVE-2026-102489.
Tia coverage
First reported2026-09-29
First exploit report2026-09-30
Exploit report → KEV2 days before the listing
When Tia's reporting first covered this CVE and whether a report claimed exploitation before the KEV listing. Lead-time deltas are measured from the exploitation report only — plain coverage is not exploitation intel. See the story links under Mentioned in for coverage detail.
Mentioned in
automated-ai-agent-used-to-breach-cybersecurity-nonprofit-divdzammad-critical-vulnerabilities-enable-remote-code-execution-and
Record schema v1.0. Enrichment is research-grade, not a substitute for analyst review.