On October 2, 2026, CISA added two Zammad CVEs to its KEV catalog, on the same day, with the same deadline: October 5. Zammad is an open-source helpdesk and ticketing platform, often self-hosted and internet-facing so customers can open tickets.
The two flaws are chainable, and CISA says so explicitly in both entries: the first yields code execution as the zammad user, the second takes that user to root.
| CVE-2026-102489 | CVE-2026-102490 | |
|---|---|---|
| Class | session fixation / hijack → RCE | improper privilege management → root |
| CVSS 3.1 | 9.8 (CRITICAL) | not published by NVD as of writing |
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H | not published |
| NVD published | 2026-09-30 | not yet |
| CISA KEV | added 2026-10-02, due 2026-10-05 | added 2026-10-02, due 2026-10-05 |
CVE-2026-102489: From Session Hijack to Code Execution
a session hijack vulnerability that leads to remote code execution as the zammad user
CISA classifies it as session fixation. The principle of this class of flaw: the application accepts a session identifier imposed or obtained by the attacker, who then ends up inside a legitimate user's session. Here, NVD says it leads to code execution as the zammad system account, with no prior authentication according to the vector.
I won't detail the mechanism: Zammad's security advisory is the reference.
CVE-2026-102490: From the zammad User to Root
NVD hasn't published a score or affected versions as of writing. CISA describes it as improper privilege management allowing the local zammad user to escalate to root.
On its own, it requires local access. Chained with the first one, it turns an application compromise into full server takeover.
Why It Matters
A helpdesk holds more sensitive information than people assume:
- the history of exchanges with customers and staff, attachments included
- often passwords, screenshots and config snippets sent "for support"
- integrations with email, the directory (LDAP), the CRM, and their credentials
Root on that server means all of that, plus a foothold in the internal network.
Versions
According to NVD, CVE-2026-102489 affects Zammad 6.3.0 through 6.5.4.
The bug is also present in version 7.0.0 to version 7.1.2, but not exploitable due to changes in the underlying framework.
So the 7.x branch up to 7.1.2 contains the defect without it being exploitable, per NVD. That's no reason to skip the upgrade.
NVD gives no fixed version for CVE-2026-102489, and nothing at all for CVE-2026-102490. I won't make one up: the version to install is in Zammad's security advisory. Check it for both CVEs, as the second may affect different versions.
Detection
- Abnormal sessions: the same session used from different addresses or browsers, agent or admin logins at unusual hours
- Unexpected child processes under Zammad services (web server, workers)
- Modified files in the Zammad install directory and system directories, outside updates
- Agent or admin accounts created recently, new API tokens
- Signs of escalation: new scheduled tasks, added SSH keys, modified root-owned binaries
Mitigation
- Upgrade Zammad to the fixed release the vendor specifies. The CISA deadline is today.
- If you're still on 6.x, this is top priority: it's the range where NVD calls the flaw exploitable.
- Limit exposure: if the customer portal must stay public, restrict the agent and admin interface to internal networks or behind a VPN.
- Invalidate all sessions after upgrading, and rotate API tokens.
- If compromised: treat the server as lost (root is possible), rebuild it, rotate integration credentials (email, LDAP), and treat ticket contents as exposed.
Why Continuous Monitoring of Support Tools Matters
A helpdesk rarely makes the list of critical systems, yet it receives data every day that nobody would dare store anywhere else. Two chainable KEV CVEs with a three-day deadline leave no time to discover you're hosting one.
With cveo.tech, inventory your self-hosted business applications with versions, and get alerted whenever a CISA KEV CVE affects them.