Zammad: Mehrere Schwachstellen ermöglichen Ausführen von beliebigem Programmcode und Privilegieneskalation

Summary

Product

Vulnerabilities 2

• Critical 9.4
  CVE-2026-102489 Exploited Public exploit EPSS 50%

  Undisclosed RCE in Zammad v6.3 and higher

  Zammad versions 6.3.0 to 6.5.4 are vulnerable a session hijack vulnerability that leads to remote code execution as the zammad user. The bug is also present in version 7.0.0 to version 7.1.2, but not exploitable due to changes in the underlying framework.

  zammad zammad
  Sep 30, 2026

  KEV Oct 2, 2026
• Critical 9.4
  CVE-2026-102490 Exploited EPSS 11%

  Local privilege escalation in Zammad v1.5.0 to v7.2.2 installed via DEB or RPM package

  Zammad packages built with packager.io (DEB and RPM) could have allowed a local attacker who already had file system write privileges as the unprivileged zammad service account to escalate to full root privileges on the host. Service processes began running a…

  zammad zammad
  Sep 30, 2026

  KEV Oct 2, 2026

Revision history

1. 2026-10-08 #3

   Neue Updates aufgenommen

2. 2026-10-01 #2

   Präzisierung Versionsangaben

3. 2026-09-30 #1

   Initiale Fassung

References

• GitHub Advisory Database vom 2026-09-30
  https://github.com/advisories/GHSA-XMW5-M2WG-4243
• GitHub Advisory Database vom 2026-09-30
  https://github.com/advisories/GHSA-HGFF-G8G3-4XR8
• Zammad 7.2.2 Release Notes vom 2026-10-08
  https://zammad.com/en/product/releases/7-2-2