CVE-2026-102490 - PatchNow

📋 Vulnerability Details

Data Source: CIRCL

Confidence: HIGH

Exploitation Method: OTHER

CVE Published: 2026-09-30

Added to CISA KEV: 2026-10-02 2 DAYS BETWEEN CVE AND KEV

🎯 Recommendations:

URGENT PATCH: Apply the latest Zammad security update immediately — this vulnerability has been actively exploited in the wild in conjunction with CVE-2026-102489. Do not wait.
CRITICAL CHAIN RISK: Also patch CVE-2026-102489 (the RCE companion vulnerability) — without remediating both, internet-facing Zammad instances remain at critical risk of full root compromise via the documented exploit chain.
INCIDENT RESPONSE: If your Zammad instance is internet-facing, treat it as potentially compromised. Check for indicators of compromise: unexpected root-level processes, new cron jobs, SSH authorized_keys modifications, presence of webshells or backdoors, unusual outbound network connections.
CONTAINMENT: Until patches are applied, restrict internet access to Zammad behind a WAF or VPN, and enforce IP allowlisting where possible to reduce the initial access attack surface.
PRIVILEGE HARDENING: Review and harden the permissions of the 'zammad' system user — audit sudo rules, SUID/SGID binaries accessible to the zammad user, and any capabilities granted to the application process.
CONTAINER REVIEW: If running Zammad in Docker, verify containers are not running as --privileged and do not have sensitive host path mounts that would facilitate or worsen an LPE.
LOG REVIEW: Inspect system logs (auth.log, syslog, Zammad application logs) for evidence of privilege escalation attempts, unexpected root-level activity, or anomalous API calls consistent with automated exploitation.
MONITORING: Implement process-level monitoring (e.g., auditd rules) to alert on privilege escalation events from the zammad user to root, and on unexpected child processes spawned by Zammad.
PATCH PRIORITY: CRITICAL for internet-facing Zammad deployments due to confirmed active exploit chain. HIGH for internal-only deployments due to LPE risk from any compromised internal user.

🔍 Web Intelligence (Kagi · 2026-10-02)

Summary

CVE-2026-102490 is a critical local privilege escalation vulnerability affecting all versions of the Zammad ticketing system, including the latest alpha releases. The flaw allows any local user account with ownership of the Zammad application to bypass permission checks and execute operations as the root user. This vulnerability is significant because it provides a clear path to full system compromise, enabling attackers to gain complete control over the host server, modify sensitive system files, or install persistent malware.

Exploitation

Active Exploitation: This vulnerability was actively exploited in the wild as part of a high-profile, AI-powered attack on the Dutch Institute for Vulnerability Disclosure (DIVD) on September 21, 2026 ^[1]^[3].
Threat Actors/Campaigns: The attack was carried out by an autonomous AI agent, which chained this vulnerability with a separate remote code execution flaw (CVE-2026-102489) to achieve a rapid, full-system takeover ^[1].
Availability: As of late September 2026, the vulnerability has been publicly disclosed and associated with exploit chains used in real-world attacks ^[1]^[3].
Attack Prerequisites: The attack requires local access to the system, specifically a user account that owns or has access to the Zammad application; no external network authentication is required for this specific privilege escalation step once the attacker has established a foothold ^[2].

Affected Products & Patches

Affected Versions: All Zammad versions from v1.5.0 through v7.1.0-alpha are affected ^[4].
Patch/Hotfix: Users are advised to check the official Zammad security advisories for the latest patch availability and updates.
Mitigations: Until a patch is applied, administrators should restrict local system access to the Zammad environment strictly to authorized personnel and ensure the host OS is hardened to limit the impact of local privilege escalation.

Impact

System Access: Successful exploitation grants an attacker full root-level privileges on the host operating system, effectively bypassing all standard security controls ^[2].
Capability: Attackers can compromise the confidentiality, integrity, and availability of the entire host, including the ability to install malware, modify critical system configurations, and move laterally across the network ^[2].
Business Risk: For internet-facing deployments, this vulnerability is extremely high-risk; once combined with an initial entry vector (such as the RCE vulnerability CVE-2026-102489), it leads to total system takeover, potentially resulting in data breaches, long-term persistence, and significant operational downtime ^[1].

Sources

CVE-2026-102490 - Exploits & Severity - Feedly
On September 21, 2026, the Dutch Institute for Vulnerability Disclosure (DIVD) was compromised by an autonomous AI agent that chained two zero-day vulnerabilities in the Zammad ticketing system — CVE-2026-102489 (unauthenticated RCE) and CVE-2026-102490 (local privilege escalation to root) — achievi…
CVE-2026-102490 - Vulnerability Details - OpenCVE
The vulnerability allows any local account that owns the Zammad application to gain root privileges, compromising the confidentiality, integrity, and availability of the entire host. It is a classic local privilege escalation flaw where privileged operations are executed under bypassed permission ch…
Zammad Zero-Days Exploited in AI-Powered DIVD Hack
Two Zammad zero-days, CVE-2026-102489 and CVE-2026-102490, were exploited in an AI-powered attack targeting DIVD.
CVE-2026-102490 - Undisclosed LPE in Zammad v1.5.0 to v7.1.0-alpha
While CVE identifies specific instances of vulnerabilities, CWE categorizes the common flaws or weaknesses that can lead to vulnerabilities. CVE-2026-102490 is associated with the following CWEs:…

🟢 CVE-2026-102490