VULNpocalypse
CriticalVulnerabilityPatch available

Zammad CVE-2026-102489 and CVE-2026-102490: helpdesk session hijack to root, used to breach DIVD

A Zammad session hijack (6.3 to 6.5) plus a root escalation in DEB/RPM packages breached DIVD. Move to Zammad 7.2.2 or later and check logs for leaked cookies.

Published
Updated
Fixed in
Zammad 7.2.2 (packaged installs, CVE-2026-102490); CVE-2026-102489 exploitable only on 6.3.0 to 6.5.4, hardened in 7.2.0
Exploitation
Yes. Used to breach DIVD from 21 September 2026; both CVEs in CISA KEV since 2 October 2026

Live scores

CVE-2026-102489
EPSS
0.225
likely to be attacked soon
VEDAS
0.976
strong exploit evidence
On CISA KEV
Yes, since 2026-10-02
Detection rule
None yet
EPSS (chance of attack)
100.1CVE-2026-102489 EPSS over time2026-102026-11-01
VEDAS (exploit evidence)
100.9CVE-2026-102489 VEDAS over time2026-102026-11-01

Thin horizontal line: the “likely” (EPSS 0.10) or “strong” (VEDAS 0.90) threshold. Shaded “no data” areas are periods when cve-scores did not publish.

Live scores

CVE-2026-102490
EPSS
0.109
likely to be attacked soon
VEDAS
0.533
some exploit evidence
On CISA KEV
Yes, since 2026-10-02
Detection rule
Out of scope (local)
EPSS (chance of attack)
100.1CVE-2026-102490 EPSS over time2026-102026-11-01
VEDAS (exploit evidence)
100.9CVE-2026-102490 VEDAS over time2026-102026-11-01

Thin horizontal line: the “likely” (EPSS 0.10) or “strong” (VEDAS 0.90) threshold. Shaded “no data” areas are periods when cve-scores did not publish.

What happened

On 21 September 2026, an attacker broke into the ticket system of the Dutch Institute for Vulnerability Disclosure (DIVD), which runs on Zammad. DIVD noticed on 22 September and blocked access to all systems in its datacenter. It reported the bugs to Zammad on 24 September (DIVD-2026-00014; DIVD-2026-00015). The attacker reached other services and could read and exfiltrate data. Volunteer data was exposed, including DIVD email addresses and possibly contact details (Infosecurity Magazine).

Two bugs made up the chain:

  • CVE-2026-102489: a session hijack that leads to code execution as the zammad user. It affects 6.3.0 to 6.5.4. It is also present in 7.0.0 to 7.1.2 but not exploitable “due to changes in the underlying framework” (CVE record). Zammad says it first received a report in August, that 6.5 and older have been out of support “for some time”, and that it hardened the code in 7.2.0 (Zammad).
  • CVE-2026-102490: in the DEB and RPM packages built with packager.io, service processes start as root and run files that the zammad account owns and can write, before dropping privileges. An attacker with a zammad foothold can become root within seconds, because the services restart automatically. All packaged versions up to 7.2.1 are affected. Source installs and the official container images are not. It was fixed in 7.2.2 on 8 October (GitHub advisory).

The CVE records list CVSS 4.0 8.7 and 8.5, and a 9.4 score that Infosecurity Magazine gives for the chain. CISA added both CVEs to KEV on 2 October 2026 (CISA KEV).

An AI-driven attack. DIVD says the attack scripts were commented and documented, and the agents “seem to be talking to each other” in the comments (DIVD-2026-00014). Its logs show notes in which the agent explains “why what it’s doing is okay and really not phishing”. DIVD called it “an agentic AI-powered attack” (Infosecurity Magazine).

Am I affected?

InstallVersionExposure
Any6.3.0 to 6.5.4Remote code execution (CVE-2026-102489), no security support
Any7.0.0 to 7.1.2Bug present, not exploitable per Zammad and the CVE record
DEB or RPM packageup to 7.2.1zammad user to root (CVE-2026-102490)
Source install or official container imageanyNot affected by CVE-2026-102490

Check the version and whether it is a packaged install:

bash
# DEB (Debian, Ubuntu)
dpkg -l zammad

# RPM (RHEL, CentOS, SUSE)
rpm -q zammad

# Container installs: which image tag is running
docker ps --format '{{.Image}}' | grep -i zammad

Look for exploitation. DIVD published a log check script for CVE-2026-102489 (DIVD-2026-00015). It searches Zammad and nginx logs, including rotated .gz files, for session material printed in error output. The core check is:

bash
zgrep -En 'ERROR -- :.*("Cookie"=>"|@clients=\{)' /var/log/zammad/* /var/log/nginx/* 2>/dev/null | cut -c1-240

Any hit means session cookies were written to the logs, and DIVD says to investigate further. No hit is not proof of safety. DIVD’s script itself says to also look for unfamiliar processes and files. Neither DIVD nor Zammad has published IP addresses or file IOCs.

What to do now

  1. Upgrade to Zammad 7.2.2 or later. That covers both CVEs. DIVD’s advice is to update to version 7 or take Zammad offline (Infosecurity Magazine; DIVD-2026-00015).
  2. On DEB or RPM installs, confirm the package itself is 7.2.2 or later, not just the application. The root escalation lives in how the packages run services. Source installs and the official container images were never affected by it (GitHub advisory).
  3. Restrict access to the Zammad server to trusted administrators, as Zammad recommends (Zammad). A helpdesk that only staff use does not need to be on the open internet.
  4. Run the DIVD log check on every instance that ran 6.3 to 6.5. If it finds cookies, or you find unfamiliar processes or files, assume root compromise because of CVE-2026-102490. Rebuild the host rather than cleaning it.
  5. Treat ticket data as exposed after a compromise. A helpdesk holds customer and staff contact details and ticket history. DIVD warned that its breach raises the risk of people impersonating its staff (Infosecurity Magazine). Warn the people whose tickets were stored.

Sources