Two critical vulnerabilities in Zammad have been exploited, raising significant cybersecurity concerns. These zero-day flaws allow for session hijacking and remote command execution, potentially leading to root access. The Dutch Institute for Vulnerability Disclosure (DIVD) reported these issues after they impacted their own systems.
Details of the Zammad Vulnerabilities
The first vulnerability, tracked as CVE-2026-102489, affects Zammad versions 6.3.0 through 6.5.4 and could enable remote code execution as the Zammad user. Although present in versions 7.0.0 to 7.1.3, it remains non-exploitable in those editions due to specific environmental conditions.
The second flaw, CVE-2026-102490, is a local privilege escalation vulnerability impacting all versions from 1.5.0 to 7.1.0-alpha. An attacker with local Zammad user access can exploit this to gain root privileges, granting full control over the server.
Impact and Response to the Exploits
These vulnerabilities create a high-impact attack chain. An attacker could initially exploit the session hijacking flaw to execute commands as the Zammad user and subsequently use the privilege escalation flaw to obtain root access. This level of access could enable attackers to manipulate helpdesk data, access sensitive customer tickets, and install persistent backdoors.
DIVD responded quickly, analyzing and reproducing the vulnerabilities shortly after their systems were compromised. The organization promptly informed Zammad, which is currently developing a fix. Meanwhile, DIVD has been scanning for vulnerable Zammad instances exposed to the internet and notifying their owners.
Mitigation and Precautionary Measures
Security teams using Zammad should prioritize these flaws in their incident response activities. Upgrading to the latest version or taking vulnerable instances offline until a patch is available is advised. However, the local privilege escalation issue persists even in version 7, including alpha builds.
Organizations are encouraged to review logs for unusual activity, assess for suspicious sessions, and monitor any unexpected command executions. DIVD has offered an indicator-of-compromise script to help detect potential breaches. In cases where suspicious activity is found, it is crucial to isolate the affected server, rotate credentials, and conduct thorough forensic investigations.
As these vulnerabilities were exploited before their public disclosure, simply applying patches might not eliminate attacker persistence. A comprehensive security review, including checking scheduled tasks and reviewing account changes, is essential for ensuring network integrity.
