TI-2026-65406 Aliases CVE-2026-102490 GHSA-hgff-g8g3-4xr8

Local privilege escalation in Zammad v1.5.0 to v7.2.2 installed via DEB or RPM package

CRITICAL 100Exploited in the wildCWE-269Published 2026-09-30 · Updated 2026-10-08

Key facts

Attack vector: Network
Privileges required: None
User interaction: Passive
Attack complexity: Low
Attack requirements: None
Impact type: Privilege escalation
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-269.

Summary

Zammad packages built with packager.io (DEB and RPM) could have allowed a local attacker who already had file system write privileges as the unprivileged zammad service account to escalate to full root privileges on the host. Service processes began running as root and executed files that were owned and writable by the zammad account before dropping their identity to that account. An attacker holding that foothold could have escalated within seconds, because the affected services were restarted automatically whenever they stopped; no administrator interaction was required. Only installations from the DEB and RPM packages were affected — installations from source or the official container images were not. All released packaged versions were affected.

Why it matters now

Exploitation Active In CISA KEV since 2026-10-02CISA due date 2026-10-05

EPSS 0.10936 95th percentileScored 2026-11-07

Fix Fixed Zammad (Zammad GmbH): 7.2.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Active
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Zammad GmbH	Zammad	1.5.0 to before 7.2.2	7.2.2	Patch available	CNA

Zammad VendorZammad GmbH Affected 1.5.0 to before 7.2.2 Fixed in 7.2.2 Patch available CNA

CPE configurations NVD · 3

CPE	Versions	Role	Vendor
cpe:2.3:a:zammad:zammad::::::::	before 7.2.2	Vulnerable	Zammad GmbH
cpe:2.3:a:docker:docker:-:::::::*	not specified by NVD	Running on	Docker
cpe:2.3:o:linux:linux_kernel:-:::::::*	not specified by NVD	Running on	Linux

cpe:2.3:a:zammad:zammad:*:*:*:*:*:*:*:* Versions before 7.2.2 Vulnerable ·Zammad GmbH
cpe:2.3:a:docker:docker:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Docker
cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Linux

Remediation

Fix · CNA Zammad (Zammad GmbH) Fixed in 7.2.2

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

Advisory · 2026-09-30
Zammad — zammad.com/en/advisories/cve-2026-102489-cve-2026-102490
2 records Highest priority Priority CRITICAL 2 CRITICAL
Other records, highest priority first
- TI-2026-65405 Undisclosed RCE in Zammad v6.3 and higherPriority CRITICAL 100
Show all 2 records → Advisory →

Timeline

2026-10-02 Added to CISA KEV
2026-10-02 Threatist record created from CVE-2026-102490
2026-10-03 Alias added: GHSA-hgff-g8g3-4xr8
2026-10-07 2 new references · CNA
2026-10-09 Title updated · CNA
2026-10-09 Fix available: Zammad GmbH/[email protected] · CNA
2026-10-09 1 new reference · CNA
2026-10-09 CVSS score changed · NVD
2026-10-25 EPSS moved to the 50th–90th percentile
2026-10-29 EPSS moved to the 95th–99th percentile

References

Advisory 4

TI-2026-65405 Undisclosed RCE in Zammad v6.3 and higher KEVCVSS 4.0CRITICAL 9.4
TI-2024-22252 An issue was discovered in Zammad before 6.3.0. CVSS 3.1CRITICAL 9.1
TI-2022-23785 A vulnerability in Zammad v5.3.0 allows attackers to execute arbitrary code or escalate… CVSS 3.1CRITICAL 9.8
TI-2021-18599 An issue was discovered in Zammad before 4.1.1. CVSS 3.1CRITICAL 9.8
TI-2021-18603 An issue was discovered in Zammad before 4.1.1. CVSS 3.1CRITICAL 9.8
TI-2020-15897 An issue was discovered in Zammad before 3.4.1. CVSS 3.1CRITICAL 9.8

See all 91 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences