Skip to content
OpenAdvisories

Vendor

zammad

49 known vulnerabilities.

Products

zammad 49
All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Critical 9.4
    CVE-2026-102490 Exploited EPSS 11%

    Local privilege escalation in Zammad v1.5.0 to v7.2.2 installed via DEB or RPM package

    Zammad packages built with packager.io (DEB and RPM) could have allowed a local attacker who already had file system write privileges as the unprivileged zammad service account to escalate to full root privileges on the host. Service processes began running a…

    zammad zammad
    KEV Oct 2, 2026
  • Critical 9.4
    CVE-2026-102489 Exploited Public exploit EPSS 50%

    Undisclosed RCE in Zammad v6.3 and higher

    Zammad versions 6.3.0 to 6.5.4 are vulnerable a session hijack vulnerability that leads to remote code execution as the zammad user. The bug is also present in version 7.0.0 to version 7.1.2, but not exploitable due to changes in the underlying framework.

    zammad zammad
    KEV Oct 2, 2026