Zammad 0-Day Vulnerabilities Exploited to Gain Remote Code Execution and Root Access

What happened?

Two critical Zammad zero-day flaws, reportedly exploited against the Dutch Institute for Vulnerability Disclosure (DIVD), could allow session hijacking, remote command execution as the Zammad service user, and potential root privilege escalation. The vulnerabilities are tracked as CVE-2026-102489 and CVE-2026-102490. DIVD published the findings under case DIVD-2026-00015 after investigating a separate breach case involving its own environment. An attacker exploited CVE-2026-102489 to compromise

Key details

• Two zero-day flaws in Zammad exploited to gain remote code execution and root access.
• CVE-2026-102490 is a local privilege escalation flaw affecting all Zammad versions from 1.5.0 through 7.1.0-alpha.
• Attack chain: remote exploitation of CVE-2026-102489 followed by local exploitation of CVE-2026-102490 to obtain root access.
• Exploitation reported against DIVD on September 21, 2026, before public disclosure.
• DIVD began scanning and notifying affected owners on September 26, 2026.
• Upgrading to Zammad version 7 or taking instances offline recommended as immediate mitigation.

Summarised by SecOraLens from Cyber Security News. Always read the original source before acting. How SecOraLens verifies advisories.