Zammad: Local privilege escalation to root in packaged installations
Deadline for US federal agencies: 5 Oct 2026
Summary
Zammad DEB and RPM packages built with packager.io let a local attacker with code execution as the unprivileged zammad service account escalate to root. Root-run services execute files owned and writable by the zammad account before dropping privileges, and the installation directory is writable by that account. Exploitation requires an existing foothold on the server, but the affected services restart automatically, so escalation can take seconds without administrator interaction. Source installations and the official container images are not affected. CISA lists the flaw as known exploited.
Affected
- Zammad DEB and RPM packages built with packager.io, versions 1.5.0 up to 7.2.1 (per the CVE record and the GitHub advisory)
- Source installations and official container images are not affected
- Versions before 1.5.0: Unknown
Fixed in
- Zammad 7.2.2 (patched version per the GitHub advisory GHSA-p97w-927q-8vxq and OSV)
- Note: Zammad 7.2.0 is not a documented fix for this CVE
Workaround
- Restrict access to the Zammad server to trusted administrators only
- Remove write access for the zammad account to service code and to anything executed as root
- No vendor-stated workaround beyond access restriction is known
Exploitation
- Actively exploited: CISA added the vulnerability to its Known Exploited Vulnerabilities catalog on 2 October 2026
- CISA SSVC assessment: exploitation active, not automatable, total technical impact
- Requires local access as the zammad account; not exploitable remotely on its own
Our recommendation
- Update all packaged Zammad installations (DEB/RPM) to 7.2.2 or later, and to a version still supported by the vendor
- Restrict local access to the server to trusted administrators
- Audit file ownership and recent changes in the Zammad installation directory
- Check for signs of root compromise; rebuild or replace any host where compromise is suspected
- Monitor for unexpected root processes and service restarts
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-p97w-927q-8vxq github.com
- Zammad Security Advisory CVE-2026-102489 and CVE-2026-102490 zammad.com
- DIVD CSIRT advisory CVE-2026-102490 csirt.divd.nl
- DIVD case DIVD-2026-00015 csirt.divd.nl
- CISA Known Exploited Vulnerabilities catalog entry CVE-2026-102490 www.cisa.gov
- OSV entry CVE-2026-102490 osv.dev
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 13:27.
Original description (NVD)
Zammad packages built with packager.io (DEB and RPM) could have allowed a local attacker who already had file system write privileges as the unprivileged zammad service account to escalate to full root privileges on the host. Service processes began running as root and executed files that were owned and writable by the zammad account before dropping their identity to that account. An attacker holding that foothold could have escalated within seconds, because the affected services were restarted automatically whenever they stopped; no administrator interaction was required. Only installations from the DEB and RPM packages were affected — installations from source or the official container images were not. All released packaged versions were affected.
Required action (CISA)
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
NVD references (5)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.