CVE-2026-102490

Local privilege escalation in Zammad v1.5.0 to v7.2.2 installed via DEB or RPM package

Exploited in the wild. In CISA KEV since 2026‑10‑02. Fixed in 7.2.2.

CVSS 3.17.8High EPSS percentile44th0.5% chance in 30 days CISA KEVListedsince 2026-10-02, due 2026-10-05
No public exploit known Fix7.2.2Upgrade to this build

Published 2026-09-30Updated 2026-10-09Sources: CVE.org, NVD

NVD CVE.org

What to do

Find your product and version, then upgrade to the build on the right.

Zammad GmbH ZammadAffected: ≥ 1.5.0, < 7.2.2Upgrade to: 7.2.2Stated by: CVE record

Versions as the sources state them. Full version matrix after sign-in

Steps

Written by AI from the record

Check whether your business runs Zammad and identify its installed version.
Upgrade Zammad to 7.1.0 or later, using the vendor’s supported update process.
If you cannot update immediately, restrict access to the Zammad server and investigate for unexpected administrator activity or data exports.
Ask your IT provider to confirm the update and review the server for signs of compromise.

Usually a quick update

Is your organisation exposed?Request an assessment to establish which checks fit your systems.

Coverage timeline

3 publishers

Added to CISA KEV catalog
Oct 2, 2026·CISA KEV
Exploitation reported in the wild
as reported · Oct 1, 2026·Help Net Security summary

Sourced from public security reporting — each date is when it was published, not when it happened. 3 further articles named this CVE in wider roundups without reporting it as a distinct event.

What it is

From the CVE record

Zammad packages built with packager.io (DEB and RPM) could have allowed a local attacker who already had file system write privileges as the unprivileged zammad service account to escalate to full root privileges on the host. Service processes began running as root and executed files that were owned and writable by the zammad account before dropping their identity to that account. An attacker holding that foothold could have escalated within seconds, because the affected services were restarted automatically whenever they stopped; no administrator interaction was required. Only installations from the DEB and RPM packages were affected — installations from source or the official container images were not. All released packaged versions were affected.

In plain language

Written by AI from the record

Zammad versions from 1.5.0 through 7.1.0-alpha have a critical flaw that can let attackers take over the server, so small businesses using it should act now.

CVE-2026-102490 is a network-reachable privilege-management flaw (CWE-269) that allows code running as the local zammad user to escalate to root and fully compromise the host.

If you're affected

Full server takeover
Customer ticket exposure
Support data theft
Service disruption
Ransomware risk

What is it

This is a weakness in Zammad’s handling of system permissions. It is like a staff key that can unexpectedly open the building’s master-control room, allowing an intruder to take control of the whole server and its contents.

Who is affected

This matters to you if you use or run Zammad for customer support or help-desk tickets. The reported condition involves an attacker operating with the local zammad account’s access; Zammad is especially exposed when it is reachable from the internet.

How urgent is it

Attackers are already exploiting this vulnerability in real breaches, including an incident reported on September 21, 2026. Treat this as an emergency: CISA added it to its known-exploited list and set October 5, 2026 as the remediation deadline for covered organizations.

What to do — in detail

Confirm whether Zammad is installed, record the deployed version, and identify every internet-facing instance and underlying server.
Move affected installations to Zammad 7.1.0 or later through the supported vendor upgrade path. The patch findings also list 7.1.0-alpha and 1.5.0, but the affected-range reporting conflicts with those entries; use the stable 7.1.0 target rather than relying on an alpha build.
Test the upgrade against your integrations, customizations, and backup/restore process before production deployment where feasible; preserve logs and a backup before changing the host.
If patching is delayed, remove public access where operationally possible, limit access to trusted networks, and restrict exposure of the Zammad host while arranging the upgrade.
Review server and Zammad logs beginning before September 21, 2026 for unexpected sessions, command execution, privilege changes, administrator activity, and unusual data exports. Investigate suspicious activity as a possible compromise.
For organizations subject to CISA BOD 26-04, apply vendor mitigations and meet the CISA due date of 2026-10-05; if mitigations are unavailable, follow applicable cloud-service guidance or discontinue use.

Technical context

Severity is Critical (CVSS 9.8; AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). The reported weakness is CWE-269, improper privilege management: an unauthenticated network attack path can lead to execution in the local zammad user context and escalation to root. CISA KEV listing and dated breach reporting confirm exploitation in the wild; no public exploit code is on record. The reported exploitation included session hijacking, remote code execution, root privilege escalation, and data exfiltration. EPSS is intentionally omitted because confirmed exploitation supersedes that prediction.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS44th

CISA KEV

Listed as exploited in the wild since 2026-10-02.

US federal agencies must remediate by 2026-10-05.

Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

Public exploits

No public exploit or proof of concept found in the sources we track.

EPSS

0.5% chance of exploitation activity in the next 30 days, which ranks it in the 44th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

16 events over 12 days, from the signal feeds we watch.

2026-10-12Analysis publishedAn AI Agent Breached the Group That Hunts Vulnerabilities for a Living. It Took Seconds to Go From Session Hijack to Root.
2026-10-09Patch availablerecord updated
2026-10-08Patch availablerecord updated
2026-10-07Patch availablerecord updated, record updated
2026-10-03Record updated
2026-10-02Added to CISA KEVrecord updated, record updated

Affected products

zammadcommercial · DE
- zammadWeb AppOn-premEnterprise Software / itsm-monitoring
Zammad GmbHcommercial
- ZammadSaaSEnterprise Software / itsm-monitoring

Technical detail

CVSS 3.1 vector

Open in the CVSS calculator

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Scored 7.8 by NVD.

How it is reached

Attack Vector LocalRequires local access to the vulnerable system (e.g. local login, malicious file)
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required LowRequires basic user-level privileges
User Interaction NoneNo user interaction needed — fully automated exploitation

Scope

Scope UnchangedImpact is limited to the vulnerable component itself

Impact if exploited

Confidentiality HighTotal information disclosure — all data in the component is compromised
Integrity HighTotal loss of integrity — attacker can modify any data in the component
Availability HighTotal denial of service — the component is completely unavailable