Zammad, unauthenticated code execution (CVSS 4.0 8.7, 9.4 chained with CVE-2026-102490), exploited in the DIVD breach

CVE-2026-102489 / CVE-2026-102490, Zammad helpdesk: a session-hijack remote code execution and a zammad-to-root escalation, both exploited since 21 September, and the root flaw is unfixed

DIVD, the Dutch Institute for Vulnerability Disclosure, says attackers first reached its systems on 2026-09-21 and that they got in through two zero-days in Zammad, the customer-service ticketing software, which together allowed session hijacking, remote code execution and privilege escalation from the Zammad user to root "in seconds" (DIVD CSIRT, 2026-10-01). From there the attackers reached other services and exfiltrated data; DIVD says network segmentation and its incident response stopped them going deeper, and that volunteer data such as email addresses and possibly contact details left the network (DIVD CSIRT, 2026-10-01). DIVD assesses the attack as driven by an AI agent, because the attacker's scripts carry notes in which the agent justifies its own actions, and says it sees no link to a known threat actor (DIVD CSIRT, 2026-10-01).

CVE-2026-102489 is a session hijack that leads to remote code execution as the zammad user in versions 6.3.0 to 6.5.4; the defect is also present in 7.0.0 to 7.1.3 but DIVD says it is not exploitable there because of environment conditions (DIVD CSIRT, 2026-10-01). NCSC-NL describes it as exploitable by an attacker who has not logged in (NCSC-NL, 2026-09-30), while DIVD's CVE record scores it CVSS 4.0 8.7 with passive user interaction (DIVD CSIRT, 2026-09-29). CVE-2026-102490 lets the local zammad user escalate to root in all versions including the latest alpha, and DIVD scores the pair 9.4 when chained (DIVD CSIRT, 2026-09-29). NCSC-NL states both flaws have been actively exploited since 2026-09-21, rates likelihood and damage as high, says Zammad has released an update for the first flaw only, and says the second "is not yet fixed" (translated from Dutch) (NCSC-NL, 2026-09-30). DIVD's case page instead lists patch status Available, recommends upgrading to Zammad 7 or taking Zammad offline, and says it is scanning for and notifying owners of vulnerable instances (DIVD CSIRT, 2026-10-01).

Exposure: self-hosted Zammad. The code-execution flaw needs a version from 6.3.0 to 6.5.4; the root escalation is present in every version from 1.5.0, so it matters as the second stage after the code-execution flaw or any other foothold as the zammad user. No source says whether hosted Zammad is affected.

Builds on: BSI flags 13 vulnerabilities patched in Zammad 7.1, admin privilege escalation in a DACH…