All versions of the Zammad helpdesk, including the latest alpha, let the local zammad system user escalate privileges to root. The flaw is a local privilege escalation on hosts where that account exists; the advisory does not describe a separate unauthenticated remote code-execution bug. A successful escalation gives full root control of the Zammad server, including tickets, credentials, and the underlying operating system. Every Zammad installation is in scope because no unaffected version is identified. CVSS 4.0 scores it 9.4 critical with exploit maturity Attacked (E:A); it is not listed in CISA KEV and no public proof-of-concept is known.
What to do: Treat every Zammad host as vulnerable: no fixed release is named in the advisory, and all versions including the latest alpha are affected. Restrict login and sudo/polkit rights for the local zammad system account, review that account for unexpected privileges, and apply a vendor or DIVD patch as soon as one is published. Watch the host for unexpected root processes owned by or spawned from the zammad user.
Affected
Zammad GmbH Zammad
All versions, including the latest alpha
Estimated exposure
moderateOn the order of 1,000–10,000 self-hosted Zammad servers — Zammad is a widely used self-hosted open-source helpdesk, mainly in organizations rather than by consumers; the advisory gives no install count or internet-scan total, so this is an order-of-magnitude estimate of server installations, not…
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description
All versions of Zammad including the latest alpha enable the local zammad user to escalate privileges to root.
CISA Known Exploited Vulnerability
Affected
Zammad GmbH Zammad
Required action
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Attackers chained two Zammad zero-days to breach DIVD and steal volunteer researchers' email addresses.
On September 21, attackers breached the Dutch Institute for Vulnerability Disclosure through two zero-days in its Zammad helpdesk, CVE-2026-102489 and CVE-2026-102490. The chain leaked sessions, ran code as the zammad user, and escalated to root within seconds. Stolen data includes volunteer email addresses and possibly other contact details. DIVD said the messy, self-commenting scripts suggest an agentic AI operator and advised all Zammad users to upgrade to version 7 or take systems offline.
Attackers exploited two Zammad zero-days for remote code execution and root, including a breach of DIVD.
Two Zammad zero-days, CVE-2026-102489 and CVE-2026-102490, were exploited in the wild, including against the Dutch Institute for Vulnerability Disclosure on 21 September 2026. CVE-2026-102489 is a session-hijacking flaw in Zammad 6.3.0 through 6.5.4 that can lead to remote command execution as the Zammad service user; the issue also exists in 7.0.0–7.1.3 but researchers said those releases were not exploitable under observed conditions. CVE-2026-102490 is a local privilege escalation to root affecting every version from 1.5.0 through 7.1.0-alpha. Chained, the bugs can yield full server control, ticket and attachment theft, and persistence; DIVD reported the issues on 24 September and recommends upgrading to version 7 or taking systems offline while noting the privilege-escalation bug still affects version 7.
Chained Zammad zero-days let an AI agent breach DIVD, gain root in seconds, and exfiltrate data; users urged to update to version 7.
DIVD, the Dutch Institute for Vulnerability Disclosure, was breached after attackers chained two previously unknown Zammad flaws, CVE-2026-102489 and CVE-2026-102490, in its internal helpdesk platform. The chain enabled session hijacking, remote code execution, and escalation from the Zammad user to root within seconds, accelerated by an autonomous AI agent that executed attack steps without human direction. The attacker pivoted to other services and exfiltrated some data before network segmentation and rapid incident response contained the damage. DIVD urges all Zammad users (over 2,000 customers, 55,000 users) to update to version 7 or take instances offline, and published a script to check logs for abuse.
Attackers used an agentic AI to chain two Zammad zero-days into DIVD's network, hijacking sessions, gaining root, and exfiltrating data on September 21.
The Dutch Institute for Vulnerability Disclosure (DIVD) disclosed that a September 21 attack driven by an agentic AI exploited two Zammad zero-days to hijack sessions, execute code remotely, and escalate from the Zammad user to root, then access other services and exfiltrate data. CVE-2026-102489 is an unauthenticated RCE affecting Zammad 6.3.0-6.5.4; CVE-2026-102490 allows low-privileged authenticated attackers to reach root and affects all versions including the latest alpha; neither had a fix at publication, though CVE-2026-102489 is not exploitable in versions 7.0.0-7.1.3. DIVD reported the incident to the Dutch DPA, NCSC-NL, and police, says network segmentation limited the compromise, and advises Zammad users to upgrade to version 7 or take instances offline.
Attackers exploited two Zammad zero-days to breach DIVD, reach root, and steal volunteer contact data.
The Dutch Institute for Vulnerability Disclosure said attackers exploited two Zammad zero-days after suspicious activity was noticed on September 24. Remote code execution flaw CVE-2026-102489 and elevation-of-privilege flaw CVE-2026-102490, scored 9.4 CVSS when chained, were used to hijack sessions, run code, and escalate from the Zammad user to root within seconds. Attackers then reached other services and exfiltrated data, including volunteer email addresses and possibly contact details. DIVD said script notes in the logs indicate an agentic AI-driven attack and urged every Zammad deployment to update to version 7 or be taken offline.
Attackers exploited two Zammad zero-days in an AI-driven intrusion that hit the Dutch Institute for Vulnerability Disclosure.
The Dutch Institute for Vulnerability Disclosure said it was compromised on September 21, 2026, in what it called an agentic AI-powered attack against its Zammad ticketing system. Attackers chained CVE-2026-102489, an unauthenticated remote code execution and session-leak flaw rated CVSS 9.4, with CVE-2026-102490, a local-to-root privilege escalation also rated 9.4. They pivoted to other services and exfiltrated data, but network segmentation limited deeper access. Zammad 6.3.0 through 6.5.4 are affected; DIVD advises upgrading to version 7 or taking instances offline.
An autonomous AI agent used two Zammad zero-days to breach DIVD, gain root, and exfiltrate data within seconds.
The Dutch Institute for Vulnerability Disclosure says its network was breached by an autonomous AI agent that chained two zero-days in the Zammad helpdesk, CVE-2026-102489 and CVE-2026-102490. The flaws allowed session hijacking, remote code execution, and escalation from the Zammad user to root, after which the attacker reached other services and exfiltrated data within seconds. Segmentation and incident response limited deeper movement, and the investigation is ongoing. Working with Merlon Security, DIVD urges customers to upgrade to Zammad 7 or take vulnerable instances offline; Zammad cites more than 2,000 customers and 55,000 users.
Chained Zammad flaws CVE-2026-102489/102490 enable session hijacking, RCE, and root escalation; already used against DIVD.
DIVD and Merlon Security disclosed two Zammad vulnerabilities, CVE-2026-102489 (session hijacking leading to RCE as the Zammad service user, affecting 6.3.0–6.5.4) and CVE-2026-102490 (local privilege escalation to root, affecting 1.5.0 through 7.1.0-alpha). The chained attack carries a CVSS of 9.4 and was used in a September 21, 2026 intrusion against DIVD's own infrastructure that completed in seconds via an agentic AI-powered workflow. Fixes are included in Zammad 7.2.0; DIVD urges upgrading to version 7 and is scanning for and notifying exposed vulnerable instances.