Impact

Successful exploitation allows a local user to obtain elevated privileges on the host operating system. This could lead to full system compromise, unauthorized access to sensitive helpdesk data, or the ability to manipulate the Zammad application and its underlying data stores.

Recommendation

• Ensure Zammad is updated to the latest available version provided by the vendor to address security defects.
• Apply the principle of least privilege for all local system accounts with access to the Zammad server.
• Restrict local shell access to the server solely to authorized administrators to mitigate the risk of local privilege escalation.
• Audit existing local user accounts and groups on the server to ensure no unauthorized persistence or escalation vectors exist.

The second vulnerability, CVE-2026-102490, allows an attacker with limited access to elevate their privileges to root, granting full system control. This vulnerability currently affects all current versions of Zammad and remains unpatched as of September 30, 2026. Given the active exploitation observed in the wild, organizations running Zammad are at high risk of complete system compromise, data theft, and persistent unauthorized access. Defenders must prioritize patching the RCE vulnerability and monitoring for unauthorized privilege escalation attempts.

Attack Chain

1. Attacker performs reconnaissance to identify public-facing instances of Zammad.
2. Attacker sends specially crafted, unauthenticated HTTP requests to exploit CVE-2026-102489.
3. The target Zammad server processes the malicious request, resulting in remote code execution (RCE) with the privileges of the web service account.
4. Attacker executes post-exploitation commands to download additional tooling or establish persistence.
5. Attacker leverages the limited-privilege shell to exploit CVE-2026-102490.
6. The vulnerability in Zammad allows the attacker to escalate to root privileges.
7. Attacker gains full system control, facilitating data exfiltration, modification, or further lateral movement within the network.

Impact

Successful exploitation of these vulnerabilities allows for unauthenticated remote code execution and full root privilege escalation on Zammad instances. This provides attackers with complete control over customer support data, communication logs, and internal credentials stored within the application. Given the nature of helpdesk platforms, compromised systems may serve as a significant pivot point for broader organizational network intrusion. Active exploitation has been confirmed since September 21, 2026, posing a critical risk to all sectors utilizing Zammad.

Recommendation

• Apply the security update provided by Zammad for CVE-2026-102489 immediately across all instances of versions 6.3.0 through 6.5.4.
• For CVE-2026-102490, since no patch is currently available, increase monitoring of administrative account logins and unauthorized process execution originating from the Zammad application user.
• Before applying updates, export and secure application and network logs as recommended by the NCSC to facilitate forensic analysis should evidence of exploitation be discovered.
• Coordinate with IT-service providers to verify the current version of Zammad installations and assess exposure risk.