CISA Warns of Critical Zammad Vulnerabilities Actively Exploited

Key Takeaways

• The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued an alert regarding two critical vulnerabilities in the Zammad helpdesk platform.
• Tracked as CVE-2026-102489 and CVE-2026-102490, these flaws can be chained to achieve remote code execution followed by full root privilege escalation on affected servers.
• At least one of the vulnerabilities is actively being exploited in the wild, prompting CISA to add both to its Known Exploited Vulnerabilities catalog.
• Zammad versions 6.5 and older are most susceptible, with the vendor recommending immediate updates to version 7.2.0 or newer.

CISA Flags Actively Exploited Zammad Vulnerabilities

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added two serious Zammad vulnerabilities to its Known Exploited Vulnerabilities catalog, confirming active exploitation of at least one of the flaws. These security weaknesses, identified as CVE-2026-102489 and CVE-2026-102490, present a significant risk, as they can be exploited in sequence to gain extensive control over Zammad helpdesk servers.

Zammad, an open-source platform for customer support and ticketing, is widely utilized by organizations to manage customer interactions, service requests, and internal support operations. Given that these systems frequently handle sensitive customer data, support tickets, user credentials, and email integrations, a successful compromise could lead to severe data breaches and operational disruptions.

Understanding the Vulnerabilities

The first vulnerability, CVE-2026-102489, is a session fixation flaw primarily affecting older Zammad installations. Session fixation is a technique where an attacker manipulates a user into employing a session identifier that the attacker already possesses or can predict. Exploiting this vulnerability could enable an attacker to execute arbitrary code remotely with the privileges of a low-level Zammad user.

The second vulnerability, CVE-2026-102490, involves improper privilege management. This flaw allows a local Zammad user to escalate their privileges to root, which is the highest administrative account on Linux-based systems. When combined with the session fixation vulnerability (CVE-2026-102489), an attacker could potentially achieve a full server takeover, moving from initial remote access to complete administrative control.

CISA’s Directive and Zammad’s Response

CISA added both vulnerabilities to its catalog on October 2, 2026, mandating that federal civilian agencies remediate these issues by October 5, 2026. The agency also emphasized that Binding Operational Directive 26-04 requires forensic triage, meaning organizations must thoroughly investigate affected systems for any signs of compromise in addition to applying patches.

Zammad has acknowledged public reports related to DIVD case DIVD-2026-00015. Initially, Zammad said that CVE-2026-102489 is only exploitable on Zammad 6.5 and earlier versions, which are no longer officially supported. The vendor also stated that Zammad versions 7.0 and newer are not practically affected, and version 7.2.0 includes additional code hardening to bolster security.

Regarding CVE-2026-102490, Zammad initially lacked technical information to verify its scope or exploitation claims. However, in a subsequent update, Zammad said it received vulnerability details from DIVD and confirmed that the privilege escalation issue cannot be exploited remotely on its own. This means an attacker would first require some form of server access before being able to elevate privileges using this flaw.

This incident underscores the critical risk posed by chaining multiple vulnerabilities, where one weakness provides initial entry, and another escalates limited access into full administrative control.

What You Should Do

• Immediately update all Zammad installations to version 7.2.0 or a newer, supported release, especially if you are running version 6.5 or older.
• Conduct a comprehensive review of server logs, running processes, user accounts, scheduled tasks, SSH access logs, web server logs, and outbound network connections for any indicators of unauthorized access or compromise.
• Apply all vendor-provided mitigations and patches without delay.
• Assess the internet exposure of your Zammad instances. If adequate mitigations cannot be applied, consider discontinuing the use of the product until it can be secured.
• Perform forensic triage on any potentially affected systems as recommended by CISA, to identify and contain any active compromises.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.