Zammad CVE-2026-102489 on CISA KEV: patch your helpdesk

Your helpdesk holds every customer email, every attachment, and often the password-reset conversations for your other systems. On October 2, CISA added two Zammad flaws to its Known Exploited Vulnerabilities catalog: Zammad CVE-2026-102489, a session fixation bug, and CVE-2026-102490, a privilege escalation bug. Chained, they take an attacker from a hijacked session to root on the server. If you self-host Zammad, upgrade to 7.2.0 and then check whether someone got there first.

What actually happened

The Dutch security nonprofit DIVD found both bugs while it investigated a real breach. Per the DIVD case file, the attack happened on September 21. DIVD reproduced it by September 23, notified Zammad on September 24, and began public scanning and victim notification on September 26.

The two pieces:

• CVE-2026-102489 lets an attacker hijack a session and run code as the zammad user. DIVD lists versions 6.3.0 through 6.5.4 as exploitable. It says 7.0.0 through 7.1.3 contain the flaw but environment conditions block exploitation.
• CVE-2026-102490 lets the local zammad user escalate to root. DIVD says it reaches back to version 1.5.0.

Zammad's own community notice says the privilege bug cannot be exploited remotely by itself, because the attacker already needs access to the server. That is true, and it is also exactly what the first bug provides. Zammad tells customers to update to 7.2.0 now, and says installs on 6.5 or older are the priority.

Why it matters for your business

Old helpdesks are the soft target. A self-hosted ticket system often gets installed once and then left alone for years. The exploitable range here, 6.3 to 6.5, is exactly the "it works, don't touch it" install.

Patching does not undo a breach. CISA's notice tells agencies to check whether attackers compromised the system before the patch went on. Do the same. DIVD published an indicator-of-compromise check script with its case. Run it before you call this closed.

Root on the helpdesk is a pivot point. From that box, an attacker reads customer data, sends email that looks like your support team, and finds credentials for the systems the helpdesk talks to.

Sources: CISA KEV alert, DIVD-2026-00015, Zammad community notice.