CVE-2026-102490High· 7.8▾ Abyssal⚠ Exploited in the wildPoC availableZammad packages built with packager.io (DEB and RPM) could have allowed a local attacker who already had file system write privileges as the unprivileged zammad service account to escalate to full root privileges on the host. Service pro…
▾ Abyssal zone — Critical with a public exploit or in-the-wild use
impact 42.9 · likelihood 0.2 · exploitation 25
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Oct 1.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.3%
Federal remediation due Oct 5, 2026
Exploit / PoC code exists
8.5 → 9.8
high → critical
Last analysed / modified upstream
9.8 → 7.8
critical → high
0.3% → 0.9%
Added to the CISA catalog on Oct 2, 2026. Federal remediation due Oct 5, 2026. View catalog ↗
Zammad packages built with packager.io (DEB and RPM) could have allowed a local attacker who already had file system write privileges as the unprivileged zammad service account to escalate to full root privileges on the host. Service processes began running as root and executed files that were owned and writable by the zammad account before dropping their identity to that account. An attacker holding that foothold could have escalated within seconds, because the affected services were restarted automatically whenever they stopped; no administrator interaction was required. Only installations from the DEB and RPM packages were affected — installations from source or the official container images were not. All released packaged versions were affected.
zammad < 7.2.2Upgrade past the affected range:
zammad 7.2.2Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-102489Critical· 9.8Zammad versions 6.3.0 to 6.5.4 are vulnerable a session hijack vulnerability that leads to remote code execution as the zammad user
CVE-2026-56733High· 8.7Zammad is a web based open source helpdesk/customer support system
CVE-2024-33668Critical· 9.1An issue was discovered in Zammad before 6.3.0
CVE-2021-20021Critical· 9.8A vulnerability in the SonicWall Email Security version 10.0.9.x allows an attacker to create an administrative account by sending a crafted HTTP request to the remote host.
CVE-2026-63205Medium· 5.1Zammad is a web based open source helpdesk/customer support system
CVE-2026-84460Medium· 5.3Zammad is a web based open source helpdesk/customer support system