Content management and web applications
Zammad session hijack and local privilege escalation (CVE-2026-102489, CVE-2026-102490)
Zammad check
Zammad is an open-source helpdesk and ticket system. The Dutch Institute for Vulnerability Disclosure (DIVD) reported that two previously unknown flaws in Zammad were used to breach its own instance, with first access on 21 September 2026. CISA added both to its Known Exploited Vulnerabilities catalog on 2 October 2026. Chained, the first gives code execution as the zammad service user and the second gives root.
| Item | CVE-2026-102489 | CVE-2026-102490 |
|---|---|---|
| What | A session hijack leading to remote code execution as the zammad user |
A local privilege escalation from the zammad user to root |
| CVSS | 9.4 (CVSS 4.0, CISA) | 8.5 to 9.4, depending on who scores it |
| Affected | 6.3.0 through 6.5.4 are exploitable. The same code is in 7.0.0 through 7.1.3 but is reported as not exploitable there | DIVD lists 1.5.0 through 7.1.0-alpha |
| Vendor position | Zammad says exploitation is possible only on 6.5 and older and that 7.0 and later are not affected. 7.2.0 adds hardening | Zammad disputes the report (it says it received no technical details) It needs code already running as the zammad user |
| Exploited | Yes, in the DIVD breach (CISA KEV) | Yes, as the second step of the chain (CISA KEV) |
Zammad's advice is to update to version 7 or take the instance offline.
What this script can and cannot say
It reports the remote chain, CVE-2026-102489, from the version. It does not say that any version is fixed for CVE-2026-102490, because no source used here confirms a patch. The host's own hardening is the control for that one.
| Zammad version | Result |
|---|---|
| 6.3.0 to before 7.0.0 | Exposed: the remote chain is open. Exit 1 |
| 1.5.0 to before 6.3.0 | The session flaw does not apply, but the release is long unsupported and the local flaw is reported against it. Exit 1 |
| 7.0.0 to before 7.2.0 | The remote chain is not open. Update to 7.2.0 for the hardening. Exit 0 |
| 7.2.0 or later | Hardening for the session flaw. Exit 0, with a note about the local flaw |
A pre-release of 7.2.0 or later (the VERSION file ends in -pre) |
Not judged as the release: it may not have the hardening. Warns, exit 1. A pre-release below 7.2.0 is judged by the version it leads to |
The version is read from the VERSION file at the Zammad root (it holds just the version, for example 6.5.4), with the package version as a fallback.
Quick start
curl -fLO https://raw.githubusercontent.com/PrivacySafe/security-patches/refs/heads/main/zammad/zammad-check.sh
less zammad-check.sh
chmod +x zammad-check.sh
./zammad-check.sh check
./zammad-check.sh hunt
Commands
| Command | What it does |
|---|---|
check (default) |
Finds Zammad under ZAMMAD_ROOT, /opt/zammad or /usr/share/zammad, reads the version, and reports. Exit 0 the remote chain is not open, 1 exposed or unclear |
hunt |
Looks for persistence a root compromise would leave: changed authorized_keys, changed root and zammad crontabs, and, for review, root-owned files under the Zammad root and new SUID files. Exit 0 nothing found, 1 a lead |
version |
Prints the script version |
Env: ZAMMAD_ROOT, ZAMMAD_HUNT_SINCE (default 2026-09-21), ZAMMAD_HUNT_HOMES (directories searched for authorized_keys; default /root /home/zammad /opt/zammad) and ZAMMAD_CRON_DIRS (default /var/spool/cron/crontabs /var/spool/cron).
About the hunt
These are leads, not indicators of this particular campaign: there is no published list of indicators in the sources used. A changed authorized_keys or crontab may be an administrator's work, so confirm each. DIVD published its own log check for the campaign, which is the better source for indicators.
Update
Update to 7.2.0 or later, or take the instance offline, as Zammad advises. If you cannot update, restrict network access to Zammad to trusted addresses.
If an instance on 6.x was reachable after 21 September 2026
Treat the host as possibly compromised. Restore from a backup taken before that date, rotate every credential Zammad could read, and review accounts and keys on the host.
Sources
Before you run it
- The fix. Update to Zammad 7.2.0 or later, or take the instance offline, as Zammad advises.
- A fixed version is reported for the remote chain (CVE-2026-102489). CVE-2026-102490, the local privilege escalation the vendor disputes, is reported on its own.
- A pre-release is not the release.
7.2.0-preis reported with a warning, because it may not have the hardening. - It also reads running containers. With
SCAN_CONTAINERS=1(the default)checkreadsVERSIONunder/opt/zammadand/usr/share/zammadinside running docker and podman containers. A container whoseVERSIONcannot be read is reported as unreadable and is never judged by the host's package version.huntis host only. huntlists indicators of this campaign. It looks for changedauthorized_keys, changed root and zammad crontabs, files owned by root under the Zammad root and new SUID files since 21 September 2026. If a 6.x instance was reachable after that date, treat it as possibly compromised.
The Security Patches software and this documentation are dedicated to the public domain under CC0 1.0 Universal. Other pages on privacysafe.app/docs are CC BY-SA 4.0 unless the page says otherwise.
