Reported by 16 outlets
Zammad Critical Vulnerabilities Enable Remote Code Execution and Root Privilege Escalation
Why this score
- Breadth
- 2.00 / 2.0 · 16 sources
- Authority
- 1.80 / 2.0 · best outlet weight
- Severity
- 2.40 / 5.0 · CVSS + KEV signals
- Velocity
- 0.00 / 2.0 · updates in 48h
- Pickup speed
- 0.53 / 0.6 · time to second source
- Recency
- × 0.00 temporal multiplier
- Community
- + 0.00 / 1.5 · reddit signal
- Score
- 0.0 / 10 = base × recency + community
Desk analysis
Two critical Zammad helpdesk vulnerabilities, CVE-2026-102489 and CVE-2026-102490, were discovered during a breach investigation at the Dutch Institute for Vulnerability Disclosure (DIVD). Together they allow remote code execution and root-level server control. The more severe, CVE-2026-102490, is a local privilege escalation listed in CISA KEV and described as actively exploited; it lets a local zammad user gain root. A new event confirms the KEV status and exploitation claim. The breach investigation that uncovered the flaws is significant because it ties the discovery to a real incident at a security nonprofit.
Timeline
-
original reporting
Zammad Vulnerabilities Let Attackers Execute Code and Escalate Privileges to Root
gbhackers.com · 11d ago · October 2nd, 2026
Two critical vulnerabilities in the open-source Zammad helpdesk and ticketing platform can be exploited together, enabling attackers to achieve remote code execution and gain root-level control of affected servers. The Dutch Institute for Vulnerability Disclosure (DIVD) and Merlon Security discovered these vulnerabilities, tracked as CVE-2026-102489 and CVE-2026-102490, during an investigation into a breach of DIVD’s […] The post Zammad Vulnerabilities Let Attackers Execute Code and Escalate Privileges to Root appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform .
-
update from zubiqo.com
A rogue AI agent hit the Dutch Institute for Vulnerability Disclosure, chaining two Zammad zero-days to get root access in seconds. The scri
zubiqo.com · 12d ago · October 2nd, 2026
A rogue AI agent hit the Dutch Institute for Vulnerability Disclosure, chaining two Zammad zero-days to get root access in seconds. The scri
via Mastodon https://zubiqo.com/news/ai-agent-hacks-divd-security-researchers-using-chained-zammad-zero-days-v0m5gv
-
mentioned by undercodenews.com
https:// undercodenews.com/autonomous-a i-agent-breached-cybersecurity-organization-using-two-zammad-zero-days-a-new-ai-driven-attacks-emerg
undercodenews.com · 12d ago · October 2nd, 2026
-
update from webflow.sysdig.com
(webflow.sysdig.com) Agentic Threat Actor Exploits Zero-Day Vulnerabilities in Zammad Helpdesk to Breach DIVD: A Case Study in AI-Driven Cyb
webflow.sysdig.com · 11d ago · October 2nd, 2026
(webflow.sysdig.com) Agentic Threat Actor Exploits Zero-Day Vulnerabilities in Zammad Helpdesk to Breach DIVD: A Case Study in AI-Driven Cyb
via Mastodon https://webflow.sysdig.com/blog/ai-agent-exploits-zammad-zero-days-in-divd-breach-what-we-know-and-how-to-detect-it
-
update from secdb.nttzen.cloud
🚨 [CISA-2026:1002] CISA Adds 2 Known Exploited Vulnerabilities to Catalog ( https:// secdb.nttzen.cloud/security-ad visory/detail/CISA-2026:
secdb.nttzen.cloud · 11d ago · October 2nd, 2026
🚨 [CISA-2026:1002] CISA Adds 2 Known Exploited Vulnerabilities to Catalog ( https:// secdb.nttzen.cloud/security-ad visory/detail/CISA-2026:
via Mastodon https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:1002
-
update from www.cve.org
CISA has updated the catalogue. GMBH is looking like Swiss cheese these days. - CVE-2026-102489: Zammad GmbH Zammad Session Fixation Vulnera
www.cve.org · 11d ago · October 2nd, 2026
CISA has updated the catalogue. GMBH is looking like Swiss cheese these days. - CVE-2026-102489: Zammad GmbH Zammad Session Fixation Vulnera
via Mastodon https://www.cve.org/CVERecord?id=CVE-2026-102489
-
update from www.yazoul.net
🚨 New security advisory: CVE-2026-102489 affects Zammad. • Impact: Remote code execution or complete system compromise possible • Risk: Atta
www.yazoul.net · 11d ago · October 2nd, 2026
• Impact: Remote code execution or complete system compromise possible • Risk: Atta
via Mastodon https://www.yazoul.net/advisory/cve/cve-2026-102489-zammad-session-hijack-rce-exploited-in-the-wild
-
update from ninjasignal.ninja
🚨 NEW on CISA KEV — exploited in the wild 🛡 Zammad GmbH Zammad Zammad GmbH Zammad Improper Privilege Management Vulnerability CVE: CVE-2026-
ninjasignal.ninja · 11d ago · October 2nd, 2026
🚨 NEW on CISA KEV — exploited in the wild 🛡 Zammad GmbH Zammad Zammad GmbH Zammad Improper Privilege Management Vulnerability CVE: CVE-2026-
via Mastodon https://ninjasignal.ninja/intel/cve/CVE-2026-102490
-
mentioned by ninjasignal.ninja
🚨 NEW on CISA KEV — exploited in the wild 🛡 Zammad GmbH Zammad Zammad GmbH Zammad Session Fixation Vulnerability CVE: CVE-2026-102489 · patc
ninjasignal.ninja · 11d ago · October 2nd, 2026
-
update from www.securityweek.com
Reward: Inventory complete. Net assets: -2 zero-days, -1 clean incident record, -all your sessions. Restocking not available at this time. h
www.securityweek.com · 11d ago · October 2nd, 2026
Reward: Inventory complete. Net assets: -2 zero-days, -1 clean incident record, -all your sessions. Restocking not available at this time.
-
update from community.zammad.org
🔴 EXPLOITED CVE-2026-102490 is a privilege escalation flaw in Zammad that lets a local zammad user gain root. It is listed in CISA KEV and c
community.zammad.org · 10d ago · October 3rd, 2026
🔴 EXPLOITED CVE-2026-102490 is a privilege escalation flaw in Zammad that lets a local zammad user gain root. It is listed in CISA KEV and c
via Mastodon https://community.zammad.org/t/take-care-local-privilege-escalation-cve-2026-102490-is-reported-as-being-actively-exploited/21297
-
update from theperimetersite.com
Zammad hit the KEV on October 2. If you use Zammad helpdesk software, you have until October 5 to meet a federal deadline; today is Saturday
theperimetersite.com · 10d ago · October 3rd, 2026
If you use Zammad helpdesk software, you have until October 5 to meet a federal deadline; today is Saturday
via Mastodon https://theperimetersite.com/report/323
-
mentioned by hackread.com
⚠️📢 The Dutch Institute for Vulnerability Disclosure (DIVD) was breached through 2 # Zammad 0-days in what it describes as an “agentic AI-po
hackread.com · 10d ago · October 3rd, 2026
-
update from gbhackers.com
Autonomous AI Agent Chains Two Zammad Zero-Days in Machine-Speed Cyberattack
gbhackers.com · 8d ago · October 5th, 2026
The incident, first detected on September 22 after the attacker accessed DIVD systems a day earlier, offers a stark example of how […] The post Autonomous AI Agent Chains Two Zammad Zero-Days in Machine-Speed Cyberattack appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform .
-
mentioned by diesec.com
Zammad zero-days CVE-2026-102489 + CVE-2026-102490: session hijack to code execution to root. DIVD says an AI agent chained them in seconds.
diesec.com · 7d ago · October 6th, 2026
-
mentioned by diesec.com
(diesec.com) Critical Zammad Zero-Day Vulnerabilities Exploited in AI-Driven Attack Chain In brief - This article describes the exploitation
diesec.com · 7d ago · October 6th, 2026
-
update from horizon3.ai
(horizon3.ai) Agentic AI-Powered Attack Exploits Zero-Day Vulnerabilities in Zammad Helpdesk Application In brief - This article analyzes a
horizon3.ai · 6d ago · October 7th, 2026
(horizon3.ai) Agentic AI-Powered Attack Exploits Zero-Day Vulnerabilities in Zammad Helpdesk Application In brief - This article analyzes a
via Mastodon https://horizon3.ai/attack-research/disclosures/cve-2026-102489-zammad-session-leak-rce/
-
update from gbhackers.com
PoC Exploit Released for Zammad Vulnerability Enabling Session Hijacking and Remote Code Execution
gbhackers.com · 5d ago · October 8th, 2026
A proof-of-concept (PoC) exploit has been released for CVE-2026-102489, a critical vulnerability in Zammad that can expose active users’ session cookies and enable remote code execution (RCE) as the Zammad operating system user.
-
mentioned by horizon3.ai
(horizon3.ai) Critical Session Disclosure Vulnerability in Zammad (CVE-2026-102489) Enables Remote Code Execution In brief - This article de
horizon3.ai · 5d ago · October 8th, 2026
-
mentioned by beyondmachines.net
Autonomous AI Agent Exploits Zammad Zero-Day Chain to Breach DIVD Zammad helpdesk software has two critical vulnerabilities, CVE-2026-102489
beyondmachines.net · 2d ago · October 11th, 2026