{"id":"zammad-helpdesk-zero-days-divd-breach-oct-2026","category":"patch","status":"live","title":"Zammad helpdesk: session-hijack and root-escalation flaws CVE-2026-102489 and CVE-2026-102490 used in attacks","tldr":"Two Zammad helpdesk flaws, CVE-2026-102489 (remote code execution, 6.5 and older) and CVE-2026-102490 (local root, DEB/RPM packages), were used against DIVD. Update to Zammad 7.2.2 or later; 6.5 and older get no regular security fixes.","summary":"Zammad is open-source helpdesk and ticketing software. Two flaws in it were used in a September 2026 attack on the Dutch Institute for Vulnerability Disclosure (DIVD), and CISA listed both as exploited on 2 October. CVE-2026-102489, a session-fixation flaw, lets an attacker run code as the zammad user; Zammad says this is exploitable only on version 6.5 and older, and DIVD says 7.0 to 7.1.3 are not exploitable in practice. CVE-2026-102490 lets that user become root. Zammad's GitHub advisory limits it to DEB and RPM packages built with packager.io, versions 7.2.1 and earlier, and says source installs and official containers were not affected; DIVD had described it as affecting every version. Zammad 7.2.2 (8 October) fixes it. Zammad 6.5 is no longer supported, though an emergency 6.5.5 release appeared on 15 October for an unnamed critical flaw. Zammad said it could not itself verify the exploitation reports. A proof-of-concept for CVE-2026-102489 was published on 8 October, according to Help Net Security.","action":"If you run Zammad, update to 7.2.2 or later (version 7.0 or later for CVE-2026-102489), and move off 6.5 or older. Limit server access to trusted administrators and check logs for signs of compromise, as DIVD advises.","product":"Zammad helpdesk and ticketing software","audience":"work","severity":"critical","patch":"partial","exploited":true,"cves":["CVE-2026-102489","CVE-2026-102490"],"tags":["zammad","helpdesk","zero-day","privilege-escalation","remote-code-execution","divd","cisa-kev"],"affected":["Zammad 6.5 and older (CVE-2026-102489; DIVD gives 6.3.0 to 6.5.4)","Zammad DEB/RPM packages built with packager.io, 7.2.1 and earlier (CVE-2026-102490)"],"fixed":["7.2.2 (CVE-2026-102490)","7.2.0 and later include hardening for CVE-2026-102489; 7.0 and later not affected in practice","6.5.5 emergency release, flaw not named"],"matches":[],"sources":[{"kind":"advisory","title":"Zammad advisory: CVE-2026-102489 and CVE-2026-102490","url":"https://zammad.com/en/advisories/cve-2026-102489-cve-2026-102490","by":"Zammad GmbH","date":"2026-10-05"},{"kind":"advisory","title":"Local privilege escalation to root in DEB/RPM packages (GHSA-p97w-927q-8vxq)","url":"https://github.com/zammad/zammad/security/advisories/GHSA-p97w-927q-8vxq","by":"Zammad (GitHub)","date":"2026-10-08"},{"kind":"advisory","title":"Zammad releases","url":"https://zammad.com/en/product/releases/","by":"Zammad GmbH","date":"2026-10-15"},{"kind":"post","title":"Take care: CVE-2026-102490 is reported as being actively exploited","url":"https://community.zammad.org/t/take-care-local-privilege-escalation-cve-2026-102490-is-reported-as-being-actively-exploited/21297/2","by":"Zammad community","date":"2026-10-01"},{"kind":"news","title":"AI agent used Zammad zero-days to breach Dutch vulnerability disclosure non-profit","url":"https://www.helpnetsecurity.com/2026/10/01/divd-agentic-ai-attack-breach/","by":"Help Net Security","date":"2026-10-01"}],"started":"2026-10-02","closed":null,"created":"2026-11-03T21:59:30.830Z","updated":"2026-11-03T21:59:30.830Z","cve_notes":[{"cve":"CVE-2026-102489","name":"Session fixation leading to code execution in Zammad","what":"A session-fixation flaw in Zammad that lets an attacker hijack a session and run code as the zammad user; Zammad says it is exploitable only on 6.5 and older.","severity":"critical","cvss":9.8},{"cve":"CVE-2026-102490","name":"Local root escalation in Zammad DEB/RPM packages","what":"In packager.io-built DEB and RPM packages, services running as root used files the zammad user could write, so someone already running code as that user could become root.","severity":"high","cvss":7.8}],"timeline":[{"at":"2026-10-15","added":"2026-11-03T21:58:27.032Z","kind":"new-fix","text":"Zammad released 6.5.5, an emergency security fix for a critical vulnerability in the unsupported 6.5 series. The release page does not name the CVE.","url":"https://zammad.com/en/product/releases/","by":"Zammad GmbH","patch":null},{"at":"2026-10-08","added":"2026-11-03T21:58:27.032Z","kind":"new-fix","text":"Zammad 7.2.2 was released, fixing CVE-2026-102490 in DEB and RPM packages. GitHub's advisory lists 7.2.1 and earlier as affected and says source installs and official container images were not.","url":"https://github.com/zammad/zammad/security/advisories/GHSA-p97w-927q-8vxq","by":"Zammad (GitHub)","patch":"patched"},{"at":"2026-10-05","added":"2026-11-03T21:58:27.032Z","kind":"vendor-revised","text":"Zammad's advisory said CVE-2026-102490 is a local flaw linked to a confirmed packager.io vulnerability, with no fix yet. It urged anyone on 6.5 or older to update and to restrict server access to trusted administrators.","url":"https://zammad.com/en/advisories/cve-2026-102489-cve-2026-102490","by":"Zammad GmbH","patch":"partial"},{"at":"2026-10-02","added":"2026-11-03T21:58:27.032Z","kind":"cisa-added","text":"CISA added CVE-2026-102489 and CVE-2026-102490 to its list of flaws being used in attacks.","url":"https://zammad.com/en/advisories/cve-2026-102489-cve-2026-102490","by":"CISA","patch":null},{"at":"2026-10-01","added":"2026-11-03T21:58:27.032Z","kind":"other","text":"Zammad published a statement saying it could not verify the reported exploitation of CVE-2026-102490 because DIVD had not shared technical details. It said CVE-2026-102489 is exploitable only on 6.5 and older, and advised updating to 7.2.0.","url":"https://community.zammad.org/t/take-care-local-privilege-escalation-cve-2026-102490-is-reported-as-being-actively-exploited/21297/2","by":"Zammad community","patch":"partial"},{"at":"2026-09-23","added":"2026-11-03T21:58:27.032Z","kind":"new-fix","text":"Zammad 7.2 was released. Zammad later said its hardening of the code behind CVE-2026-102489 ships in 7.2.0.","url":"https://zammad.com/en/advisories/cve-2026-102489-cve-2026-102490","by":"Zammad GmbH","patch":null},{"at":"2026-09-21","added":"2026-11-03T21:58:27.032Z","kind":"disclosed","text":"Attackers used two Zammad zero-days to breach the Dutch Institute for Vulnerability Disclosure (DIVD) in an attack DIVD says was driven by an AI agent. DIVD disclosed the breach on 24 September and reported it to the Dutch data protection authority, NCSC-NL and police.","url":"https://www.helpnetsecurity.com/2026/10/01/divd-agentic-ai-attack-breach/","by":"Help Net Security","patch":null}],"url":"https://hard.fyi/live/zammad-helpdesk-zero-days-divd-breach-oct-2026/","json":"https://hard.fyi/api/live?id=zammad-helpdesk-zero-days-divd-breach-oct-2026"}