A foothold in the local zammad account can become root access on a Zammad helpdesk server. On October 2, CISA put CVE-2026-102490 on its exploited-vulnerabilities list. For teams running Zammad, the immediate question is which hosts expose that account to an attacker and what access those hosts already have to tickets, mail and connected systems.
CISA also says the local privilege flaw can chain with CVE-2026-102489. A successful chain would give an attacker a way from a remote session into the application account and then to the host’s root account. The two steps have different entry conditions; the chain’s reported remote entry is relevant especially to older Zammad releases.
From application account to root
The DIVD-assigned record for the local flaw identifies Linux and Docker deployments and describes escalation from the zammad user to root. DIVD’s structured affected range starts at 1.5.0 and ends before 7.1.0-alpha, while its prose also describes the latest alpha as affected. Version matching alone therefore cannot clear a deployed host.
CISA puts the relationship plainly: “This vulnerability can be chained with CVE-2026-102489.” The separate DIVD record for CVE-2026-102489 describes session hijacking that leads to remote code execution as the zammad user. It marks 6.3.0 through versions before 6.5.4 affected and describes the issue in 7.0.0 through 7.1.3 as blocked in practice by environment conditions. For an internet-facing helpdesk, check whether the installed release has an exploitable session-hijack path before assuming the chain begins remotely.
Vendor disputes the affected range
Zammad’s October 1 statement disputes the local flaw’s claimed scope because, it says, DIVD has yet to provide its technical details. For the separate session-hijack issue, Zammad says releases 6.5 and older are exploitable, releases 7.0 and later are protected by their runtime environment, and code hardening landed in 7.2.0. Zammad recommends updating to 7.2.0 and moving off unsupported 6.5 and older releases.
A verified first-fixed build for the local root flaw remains unavailable. Treat 7.2.0 as Zammad’s recommended upgrade, then track its advisories for a specific CVE-2026-102490 resolution. After an upgrade, inspect any host with suspicious account or root activity: replacing vulnerable code cannot erase an earlier compromise.
Scope hosts and review privilege use
Inventory Zammad servers and containers, record their installed release, and prioritize internet-reachable instances running older versions. Upgrade toward the vendor’s current 7.2.0 release, especially from unsupported 6.5 and older versions. Restrict helpdesk exposure to the networks and users that need it while reviewing the deployment’s route from the application service account to host privileges.
For any server where the zammad account may have been used by an intruder, inspect available host process-execution, authentication and privilege-elevation telemetry for that account, then use your incident-response process to triage suspicious root activity. Record the account and process history reviewed alongside the specific installed version; investigate hosts more deeply when telemetry is missing.
CISA sets October 5 as the action date in its KEV entry and directs covered federal agencies to its mitigation and forensic-triage guidance. For other operators, that date is a useful urgency signal, while Zammad’s advisory updates determine what remediation can be verified. The helpdesk holds conversations and integrations that deserve the same attention as the operating system beneath them.