Zammad helpdesk: session-hijack and root-escalation flaws CVE-2026-102489 and CVE-2026-102490 used in attacks
Two Zammad helpdesk flaws, CVE-2026-102489 (remote code execution, 6.5 and older) and CVE-2026-102490 (local root, DEB/RPM packages), were used against DIVD. Update to Zammad 7.2.2 or later; 6.5 and older get no regular security fixes.
If you run Zammad, update to 7.2.2 or later (version 7.0 or later for CVE-2026-102489), and move off 6.5 or older. Limit server access to trusted administrators and check logs for signs of compromise, as DIVD advises.
What’s happening
Zammad is open-source helpdesk and ticketing software. Two flaws in it were used in a September 2026 attack on the Dutch Institute for Vulnerability Disclosure (DIVD), and CISA listed both as exploited on 2 October. CVE-2026-102489, a session-fixation flaw, lets an attacker run code as the zammad user; Zammad says this is exploitable only on version 6.5 and older, and DIVD says 7.0 to 7.1.3 are not exploitable in practice. CVE-2026-102490 lets that user become root. Zammad's GitHub advisory limits it to DEB and RPM packages built with packager.io, versions 7.2.1 and earlier, and says source installs and official containers were not affected; DIVD had described it as affecting every version. Zammad 7.2.2 (8 October) fixes it. Zammad 6.5 is no longer supported, though an emergency 6.5.5 release appeared on 15 October for an unnamed critical flaw. Zammad said it could not itself verify the exploitation reports. A proof-of-concept for CVE-2026-102489 was published on 8 October, according to Help Net Security.
- What
- Flaw
- Affects
- Zammad helpdesk and ticketing software
- Affected
- Zammad 6.5 and older (CVE-2026-102489; DIVD gives 6.3.0 to 6.5.4)
Zammad DEB/RPM packages built with packager.io, 7.2.1 and earlier (CVE-2026-102490) - Fixed in
- 7.2.2 (CVE-2026-102490)
7.2.0 and later include hardening for CVE-2026-102489; 7.0 and later not affected in practice
6.5.5 emergency release, flaw not named - Since
- 2 Oct 2026
Timeline
- New fix
Zammad released 6.5.5, an emergency security fix for a critical vulnerability in the unsupported 6.5 series. The release page does not name the CVE.
- New fixFixed
Zammad 7.2.2 was released, fixing CVE-2026-102490 in DEB and RPM packages. GitHub's advisory lists 7.2.1 and earlier as affected and says source installs and official container images were not.
- Vendor revisedPartly fixed
Zammad's advisory said CVE-2026-102490 is a local flaw linked to a confirmed packager.io vulnerability, with no fix yet. It urged anyone on 6.5 or older to update and to restrict server access to trusted administrators.
- CISA added
CISA added CVE-2026-102489 and CVE-2026-102490 to its list of flaws being used in attacks.
- UpdatePartly fixed
Zammad published a statement saying it could not verify the reported exploitation of CVE-2026-102490 because DIVD had not shared technical details. It said CVE-2026-102489 is exploitable only on 6.5 and older, and advised updating to 7.2.0.
- New fix
Zammad 7.2 was released. Zammad later said its hardening of the code behind CVE-2026-102489 ships in 7.2.0.
- Made public
Attackers used two Zammad zero-days to breach the Dutch Institute for Vulnerability Disclosure (DIVD) in an attack DIVD says was driven by an AI agent. DIVD disclosed the breach on 24 September and reported it to the Dutch data protection authority, NCSC-NL and police.
Sources
- Zammad advisory: CVE-2026-102489 and CVE-2026-102490Zammad GmbH · 5 Oct 2026
- Local privilege escalation to root in DEB/RPM packages (GHSA-p97w-927q-8vxq)Zammad (GitHub) · 8 Oct 2026
- Zammad releasesZammad GmbH · 15 Oct 2026
- Take care: CVE-2026-102490 is reported as being actively exploitedZammad community · 1 Oct 2026
- AI agent used Zammad zero-days to breach Dutch vulnerability disclosure non-profitHelp Net Security · 1 Oct 2026