cyfenced.com →

[ CVE-2026-102490 · Published 30 Sep 2026 ]

Local privilege escalation to root in Zammad DEB and RPM packages

Exploited · CISA KEV CVSS 7.8 EPSS <1%3 agency advisoriesNo fix listed yet

[ Why it matters ]Priority signals

  • Exploited in the wild: on CISA's Known Exploited Vulnerabilities list since 2026-10-02
  • Urgent advisory from NCSC-NL

[ Analyst view ]Is this a red alert for you?

Patch within days

CISA lists it as exploited, but it needs local access as the zammad account first.

Red alert if
You run Zammad from the DEB or RPM packages on 6.3.0 to 6.5.4 and it is reachable from the internet, so CVE-2026-102489 gives attackers the foothold this flaw needs.
Can wait if
You run Zammad from source or the official container images, or you use the hosted service.
What it is
In Zammad installed from the DEB or RPM packages, service processes start as root and run files that the zammad service account can change. An attacker who can already write files as that account can become root within seconds. All packaged versions before 7.2.2 are affected; source installs and the official container images are not.
Impact
On its own this flaw needs an existing foothold as the zammad user, so it cannot be used from the internet directly. Combined with the remote flaw CVE-2026-102489, an attacker can go from the internet to full control of the helpdesk server, including all customer conversations stored on it.

How an attack would work MITRE ATT&CK

  1. T1190 Exploit Public-Facing ApplicationThe foothold as the zammad user typically comes from a remote flaw such as CVE-2026-102489.
  2. T1543 Create or Modify System ProcessThe attacker changes files that the root-started Zammad services run.
  3. T1068 Exploitation for Privilege EscalationThe services restart automatically and run the attacker's code as root.

What to do

  1. Upgrade Zammad to 7.2.2 or later from the official packages.
  2. Check files owned by the zammad account in the installation directory for changes you did not make.
  3. Look for unknown root processes, cron jobs or system services on the server.
  4. If you find signs of compromise, rebuild the server and rotate all credentials Zammad stores.
Written with AI from the sources on this page on 23 Oct 2026. Check the vendor's advisory before you act.

[ Description ]Official description

Zammad packages built with packager.io (DEB and RPM) could have allowed a local attacker who already had file system write privileges as the unprivileged zammad service account to escalate to full root privileges on the host. Service processes began running as root and executed files that were owned and writable by the zammad account before dropping their identity to that account. An attacker holding that foothold could have escalated within seconds, because the affected services were restarted automatically whenever they stopped; no administrator interaction was required. Only installations from the DEB and RPM packages were affected — installations from source or the official container images were not. All released packaged versions were affected.

CISA: Zammad GmbH Zammad contains an improper privilege management vulnerability that can allow the local zammad user to escalate privileges to root. This vulnerability can be chained with CVE-2026-102489.

[ Fixes ]Fixes and patches

CISA required action (US federal deadline 5 Oct 2026): Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.

[ Advisories ]Government CERT advisories

[ References ]References