Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

2 records

Advisory: Zammad — zammad.com/en/advisories/cve-2026-102489-cve-2026-102490 Clear all filters
TI-2026-65406 CVE-2026-102490 · GHSA-hgff-g8g3-4xr8

Local privilege escalation in Zammad v1.5.0 to v7.2.2 installed via DEB or RPM package

Priority CRITICAL 100KEV

Zammad packages built with packager.io (DEB and RPM) could have allowed a local attacker who already had file system write privileges as the unprivileged zammad service account to escalate to full root privileges on the…

CVSS 4.0CRITICAL 9.4 Network No auth User interaction EPSS 0.10936 Published 2026-09-30 Fixed in 7.2.2 CWE-269
TI-2026-65405 CVE-2026-102489 · GHSA-xmw5-m2wg-4243

Undisclosed RCE in Zammad v6.3 and higher

Priority CRITICAL 100KEV

Zammad versions 6.3.0 to 6.5.4 are vulnerable a session hijack vulnerability that leads to remote code execution as the zammad user.

CVSS 4.0CRITICAL 9.4 Network No auth User interaction EPSS 0.49915 Published 2026-09-30 Fixed in 6.5.4 CWE-384