psf-zammad-check(8)

Script: /opt/psf-security-patches/zammad/zammad-check.sh. Tool page: Zammad. Source. With the package installed: man psf-zammad-check.

Zammad session hijack and local privilege escalation: read-only checker  (v2)
CVE-2026-102489 and CVE-2026-102490

If this software is helpful, consider a donation to our 501c3 nonprofit:
https://privacysafe.foundation

Zammad is an open-source helpdesk and ticket system. The Dutch Institute for
Vulnerability Disclosure (DIVD) reported that two previously unknown flaws in Zammad
were used to breach its own instance, with first access on 21 September 2026. CISA
added both to the Known Exploited Vulnerabilities catalog on 2 October 2026.

  CVE-2026-102489  CVSS 9.4 (CVSS 4.0, CISA)  A session hijack that leads to remote
                   code execution as the zammad service user. Exploitable on 6.3.0
                   through 6.5.4. The same code is present in 7.0.0 through 7.1.3 but
                   is reported as not exploitable there. Zammad says exploitation is
                   possible only on 6.5 and older and that 7.0 and later are not
                   affected. 7.2.0 contains hardening for it.
  CVE-2026-102490  CVSS 8.5 to 9.4 depending on who scores it  A local privilege
                   escalation from the zammad user to root. DIVD lists 1.5.0 through
                   7.1.0-alpha. Zammad disputes the report. It needs code already running as
                   the zammad user.

  Chained: CVE-2026-102489 gives code as zammad, then CVE-2026-102490 gives root.
  Zammad's advice is to update to version 7 or take the instance offline.

What this script can and cannot say. It reports the remote chain (CVE-2026-102489)
from the version. It does NOT claim that any version is fixed for CVE-2026-102490:
no source confirms a patch.

This script is read-only.

Usage:
  ./zammad-check.sh [command]
  check (default)  find Zammad, read its version, report. Exit 0 = the remote chain is
                   not open, 1 = exposed or unclear.
  hunt             look for persistence a root compromise would leave: changed
                   authorized_keys, changed root and zammad crontabs, files owned by root
                   under the Zammad root, new SUID files. These are indicators of
                   this campaign. Exit 0 = nothing found, 1 = a lead.
  version          print the script version.

Env: ZAMMAD_ROOT         the Zammad install directory (default /opt/zammad, /usr/share/zammad)
     ZAMMAD_HUNT_SINCE   YYYY-MM-DD for the hunt (default 2026-09-21)
     ZAMMAD_HUNT_HOMES   directories searched for authorized_keys
                         (default /root /home/zammad /opt/zammad)
     ZAMMAD_CRON_DIRS    crontab directories (default /var/spool/cron/crontabs /var/spool/cron)
     SCAN_CONTAINERS=1   (the default) check also reads /opt/zammad/VERSION and
                         /usr/share/zammad/VERSION inside running docker and podman containers;
                         0 skips them. The hunt is host-only.

The Security Patches software and this documentation are dedicated to the public domain under CC0 1.0 Universal. Other pages on privacysafe.app/docs are CC BY-SA 4.0 unless the page says otherwise.