CTIPilot
AI-generated · no human review · verify critical claims against the linked source. how it works →

Zammad, unauthenticated code execution (CVSS 4.0 8.7, 9.4 chained with CVE-2026-102490), exploited in the DIVD breach

cve · CVE-2026-102489

Coverage
1
first 2026-10-02 → last 2026-10-08
Latest activity
2026-10-08
Zammad: public exploit for the exploited session-leak RCE; no fix named for the root flaw; 7.2.1 replaces…
Peak priority
high
1 high
Targets
public-sector
sectors: public-sector, technology · regions: europe, dach
Sources cited
14
8 hosts

Action items (2)

Do-now tasks recorded on the entries about CVE-2026-102489, newest first. Check the date before acting on an older one.

  • Find every self-hosted Zammad instance, copy its application and network logs before changing anything, upgrade to Zammad 7.2.1 (7.2.0 is affected by the 27 advisories Zammad published on 2026-10-06, two of them critical; 6.5 and older receive no security fixes), or take it offline if it cannot be upgraded, and run DIVD's log-check script against the logs for the code-execution flaw; also check the application directory for packages installed through the admin interface that you did not install and for a mail view template that overrides the built-in password-reset email, the route Horizon3's public exploit takes.
    2026-10-02CVE-2026-102489 +1
  • Until Zammad ships a fix for CVE-2026-102490, restrict access to the Zammad server to trusted administrators, as Zammad advises (the flaw needs prior access to the host), keep Zammad off the internet or behind an authenticating reverse proxy or VPN and segment the ticket host from other internal services.
    2026-10-02CVE-2026-102489 +1

Defender insights

What each entry about CVE-2026-102489 tells a defender to do, newest first.

2026-10-02HIGHexploitedZammad: public exploit for the exploited session-leak RCE; no fix named for the root flaw; 7.2.1 replaces 7.2.0

Exposure · detection

Story timeline

  1. 2026-10-02CVE-2026-102489 / CVE-2026-102490, Zammad helpdesk: a session-hijack remote code execution and a zammad-to-root escalation, both reported exploited since 21 September, with no fix named for the root flaw
    trending-vulnerabilitiesZammad: public exploit for the exploited session-leak RCE; no fix named for the root flaw; 7.2.1 replaces 7.2.0

Hunting pivots

Affected products
Zammad
Tags
actively-exploitedai-abuseauth-bypasscisa-kevno-patchpatch-availablepoc-publicpre-authpriv-escrcevulnerabilities
ATT&CK techniques (6 across 7 tactics)

6 techniques observed across 1 entry about this entity, derived from entry metadata and body evidence, never asserted without a published entry behind it · pinned to MITRE ATT&CK v19.2 · compare on the matrix · Navigator layer (JSON)

  • Initial AccessValid Accounts · Exploit Public-Facing Application
  • PersistenceValid Accounts
  • Privilege EscalationExploitation for Privilege Escalation · Valid Accounts
  • StealthValid Accounts
  • Credential AccessSteal Web Session Cookie
  • Lateral MovementUse Alternate Authentication Material: Web Session Cookie
  • CollectionData from Information Repositories

Initial Access TA0001

T1078Valid Accounts×1

Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop. Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.

Evidence: 2026-10-02/zammad-cve-2026-102489-102490-exploited-divd-breach · ATT&CK page ↗

T1190Exploit Public-Facing Application×1

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network. The weakness in the system can be a software bug, a temporary glitch, or a misconfiguration.

Evidence: 2026-10-02/zammad-cve-2026-102489-102490-exploited-divd-breach · ATT&CK page ↗

Persistence TA0003

T1078Valid Accounts×1

Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop. Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.

Evidence: 2026-10-02/zammad-cve-2026-102489-102490-exploited-divd-breach · ATT&CK page ↗

Privilege Escalation TA0004

T1068Exploitation for Privilege Escalation×1

Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.

Evidence: 2026-10-02/zammad-cve-2026-102489-102490-exploited-divd-breach · ATT&CK page ↗

T1078Valid Accounts×1

Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop. Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.

Evidence: 2026-10-02/zammad-cve-2026-102489-102490-exploited-divd-breach · ATT&CK page ↗

Stealth TA0005

T1078Valid Accounts×1

Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop. Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.

Evidence: 2026-10-02/zammad-cve-2026-102489-102490-exploited-divd-breach · ATT&CK page ↗

Credential Access TA0006

T1539Steal Web Session Cookie×1

An adversary may steal web application or service session cookies and use them to gain access to web applications or Internet services as an authenticated user without needing credentials. Web applications and services often use session cookies as an authentication token after a user has authenticated to a website.

Evidence: 2026-10-02/zammad-cve-2026-102489-102490-exploited-divd-breach · ATT&CK page ↗

Lateral Movement TA0008

T1550.004Use Alternate Authentication Material: Web Session Cookie×1

Adversaries can use stolen session cookies to authenticate to web applications and services. This technique bypasses some multi-factor authentication protocols since the session is already authenticated.

Evidence: 2026-10-02/zammad-cve-2026-102489-102490-exploited-divd-breach · ATT&CK page ↗

Collection TA0009

T1213Data from Information Repositories×1

Adversaries may leverage information repositories to mine valuable information. Information repositories are tools that allow for storage of information, typically to facilitate collaboration or information sharing between users, and can store a wide variety of data that may aid adversaries in further objectives, such as Credential Access, Lateral Movement, or Defense Evasion, or direct access to the target information. Adversaries may also abuse external sharing features to share sensitive documents with recipients outside of the organization (i.e., Transfer Data to Cloud Account).

Evidence: 2026-10-02/zammad-cve-2026-102489-102490-exploited-divd-breach · ATT&CK page ↗

Entries about Zammad, unauthenticated code execution (CVSS 4.0 8.7, 9.4 chained with CVE-2026-102490), exploited in the DIVD breach (1)

2026-10-02 · view entry permalink →

HIGHCVE-2026-102489 +1exploitedupdatedNATOA2

CVE-2026-102489 / CVE-2026-102490, Zammad helpdesk: a session-hijack remote code execution and a zammad-to-root escalation, both reported exploited since 21 September, with no fix named for the root flaw

DIVD, the Dutch Institute for Vulnerability Disclosure, says attackers first reached its systems on 2026-09-21 and that they got in through two zero-days in Zammad, the customer-service ticketing software, which together allowed session hijacking, remote code execution and privilege escalation from the Zammad user to root "in seconds" (DIVD CSIRT, 2026-10-01). From there the attackers reached other services and exfiltrated data; DIVD says network segmentation and its incident response stopped them going deeper, and that volunteer data such as email addresses and possibly contact details left the network (DIVD CSIRT, 2026-10-01). DIVD assesses the attack as driven by an AI agent, because the attacker's scripts carry notes in which the agent justifies its own actions, and says it sees no link to a known threat actor (DIVD CSIRT, 2026-10-01).

CVE-2026-102489 is a session hijack that leads to remote code execution as the zammad user in versions 6.3.0 to 6.5.4; the defect is also present in 7.0.0 to 7.1.3 but DIVD says it is not exploitable there because of environment conditions (DIVD CSIRT, 2026-10-01). NCSC-NL describes it as exploitable by an attacker who has not logged in (NCSC-NL, 2026-09-30), while DIVD's CVE record scores it CVSS 4.0 8.7 with passive user interaction (DIVD CSIRT, 2026-09-29). CVE-2026-102490 lets the local zammad user escalate to root in all versions including the latest alpha (DIVD CSIRT, 2026-10-01), and DIVD scores the pair 9.4 when chained (DIVD CSIRT, 2026-09-29). NCSC-NL states both flaws have been actively exploited since 2026-09-21, rates likelihood and damage as high, says Zammad has released an update for the first flaw only, and says the second "is not yet fixed" (translated from Dutch) (NCSC-NL, 2026-09-30). DIVD's case page instead lists patch status Available, recommends upgrading to Zammad 7 or taking Zammad offline, and says it is scanning for and notifying owners of vulnerable instances (DIVD CSIRT, 2026-10-01).

Both vulnerabilities have been actively exploited since 21 September 2026. (translated from Dutch)

The second vulnerability (CVE-2026-102490) has not yet been resolved. (translated from Dutch)

NCSC-NL 2026-09-30

We advise all users of Zammad to upgrade to version 7 of Zammad or to take it offline.

In all versions of Zammad including the latest alpha has an vulnerability which enables the local zammad user to escalate privileges to root.

DIVD CSIRT

Exploitation is only possible on Zammad 6.5 and older, because of the runtime environment those versions use.

We first received a report about this issue in August 2026 and analysed it then.

Update to Zammad 7.2.0, the current stable release.

Zammad GmbH

Zammad GmbH Zammad contains an improper privilege management vulnerability that can allow the local zammad user to escalate privileges to root.

CISA Known Exploited Vulnerabilities Catalog 2026-10-02

This issue is related to a confirmed vulnerability in packager.io, and our team is working on a solution.

An attacker would need access to the underlying server beforehand to exploit the vulnerability and escalate privileges.

Zammad 7.2.1 is an important security update that addresses critical vulnerabilities.

An attacker without any account could use this to register on an email address they did not own, have that account treated as already email-confirmed, and add it to any organization in the system.

Multi-factor authentication was enforced during a normal sign-in, but not on this path.

Zammad GmbH

Once an attacker has a valid admin session cookie from the leak, they can write arbitrary files into the Zammad application directory via the package installation endpoint.

Given that the privilege escalation vector we believe to be CVE-2026-102490 remains unpatched, we will be withholding those details.

Horizon3.ai 2026-10-07
Updaterun 2026-10-04T0405Z-inteltitleheadlinesummarytagscvessourcesevidencesourcing_noteactionsbody

CISA added both CVE-2026-102489 and CVE-2026-102490 to its Known Exploited Vulnerabilities catalog on 2026-10-02 and describes them as chainable (CISA KEV catalog, 2026-10-02). Zammad published its own statement on 2026-10-01: exploitation of CVE-2026-102489 is "only possible on Zammad 6.5 and older, because of the runtime environment those versions use", those versions no longer receive security fixes, Zammad 7.0 and later are not affected, and the code is hardened in 7.2.0, the current stable release (Zammad, 2026-10-01). For CVE-2026-102490 Zammad says "DIVD has not given us any technical details about this vulnerability", so it cannot confirm the flaw, its scope or the affected versions, names no fix, and disputes DIVD's handling of the disclosure, citing a report to Zammad on 2026-09-24 and public scanning and disclosure on 2026-09-26 (Zammad, 2026-10-01). Zammad also says it first received a report about CVE-2026-102489 in August 2026 and analysed it then, which is before the exploitation DIVD dates to 2026-09-21, so the vendor may have known of the flaw before it was exploited (Zammad, 2026-10-01).

Updaterun 2026-10-06T0405Z-intelsummarycvessourcesevidencesourcing_noteactionsbody

Zammad published its own security advisory for both CVEs on 2026-10-05 (Zammad, 2026-10-05). For CVE-2026-102490 it now says it has received DIVD's technical details and is analysing the issue as a high-priority item, assesses it as a local privilege escalation that cannot be exploited remotely on its own because an attacker would need access to the underlying server beforehand, and says the issue is related to a confirmed vulnerability in packager.io and that its team is working on a solution (Zammad, 2026-10-05). The advisory names no fixed release for it. Zammad recommends that administrators still on 6.5 or older update immediately, since those versions no longer receive security updates, and that access to the underlying server be restricted to trusted administrators (Zammad, 2026-10-05).

Updaterun 2026-10-07T0404Z-intelheadlinesummarytagstechniquescvessourcesevidencesourcing_noteactionsbody

Zammad released 7.2.1 on 2026-10-06 as an important security update that addresses critical vulnerabilities, with no action needed for SaaS customers and an immediate upgrade advised for self-hosted installations (Zammad, 2026-10-06). The release comes with 27 security advisories published the same day, rated by Zammad as two critical, twelve high, ten medium and three low (Zammad advisory records, 2026-10-06); every affected range ends at 7.2.0 and none carries a CVE id yet (Zammad advisory records, 2026-10-06). 7.2.0, the release Zammad recommended on 2026-10-01, is therefore affected itself.

The two critical advisories: the public sign-up form accepted account fields it should have ignored, so an attacker without any account could register on an email address they did not own, have that account treated as already confirmed and add it to any organization, then read and reply to other customers' tickets in those organizations, with a second flaw letting a customer change fields of another customer's ticket in the same organization (Zammad advisory GHSA-79wh-8g2f-xj2c, 2026-10-06); and the email-verification flow established a fully authenticated session for an account that had never completed email verification and had multi-factor authentication configured, without the second factor, which needs possession of the account's verification email but no password and carries the account's permissions up to administrator (Zammad advisory GHSA-f3qr-94c2-7mx2, 2026-10-06). Among the high-rated advisories are a remote code execution through a template sanitizer bypass in automation configuration, a session identifier disclosed in an authenticated configuration response that enabled off-host session takeover, and a second-order SQL injection in ticket overview sorting (Zammad advisory records, 2026-10-06).

No source reports exploitation of any of the 27 flaws. Zammad's advisory of 2026-10-05 still says its team is working on a solution for CVE-2026-102490 and none of the 27 titles names that flaw, so whether 7.2.1 closes the exploited root escalation is not stated (Zammad, 2026-10-05; Zammad advisory records, 2026-10-06).

Updaterun 2026-10-08T0404Z-intelheadlinesummarytagstechniquescvessourcesevidencesourcing_noteactionsbody

Horizon3 published a reverse-engineering of CVE-2026-102489 on 2026-10-07, with a proof-of-concept repository (Horizon3, 2026-10-07). Zammad keeps the state of every connected WebSocket client, including the session Cookie header, in a class-level registry that is passed to every event; a single request to the /ws WebSocket endpoint carrying the event name base makes the dispatcher instantiate an event class that has no implementation, and the resulting error message, which includes the object's full representation, is returned to the caller together with the cookies of all active users (Horizon3, 2026-10-07). With a leaked administrator session an attacker writes files into the application directory through the package installation endpoint, overrides the built-in password-reset email view with a malicious template and triggers a password reset for any user, which executes the template as the zammad user (Horizon3, 2026-10-07).

Horizon3 says it believes the privilege escalation is CVE-2026-102490, that it remains unpatched, and that it is withholding those details (Horizon3, 2026-10-07). Horizon3's write-up names no Zammad version; Zammad's advisory of 2026-10-05 says CVE-2026-102489 is exploitable only on 6.5 and earlier (Zammad, 2026-10-05).

Builds on: BSI flags 13 vulnerabilities patched in Zammad 7.1, admin privilege escalation in a DACH…

vulnerability02 Oct 04:45Zmulti-sourceOpen finding →
Sources: NCSC-NL · DIVD CSIRT (case DIVD-2026-00015) · DIVD CSIRT (case DIVD-2026-00014) · DIVD CSIRT (CVE record) · Zammad GmbH (vendor statement) · CISA Known Exploited Vulnerabilities Catalog · DIVD log-check script · Zammad GmbH (security advisory) · Zammad GmbH (release notes) · Zammad GmbH (GitHub security advisory) · Zammad GmbH (GitHub advisory records) · Horizon3.ai

Co-occurring entities

Derived: referenced by the same focused operational entries (weekly summaries and report roundups don't count); ×N counts the shared entries.

Where this entity is cited

  • Vulns1

Source distribution

  • csirt.divd.nl5 (36%)
  • github.com2 (14%)
  • zammad.com2 (14%)
  • api.github.com1 (7%)
  • cisa.gov1 (7%)
  • community.zammad.org1 (7%)
  • horizon3.ai1 (7%)
  • ncsc.nl1 (7%)

External references

NVD · cve.org · CISA KEV

All cited sources (14)