Zammad helpdesk zero-days exploited since 21 September: update to Zammad 7.2.0 or take instances offline

Zammad helpdesk zero-days exploited since 21 September: update to Zammad 7.2.0 or take instances offline

1 October 2026: Two vulnerabilities in Zammad, the open-source helpdesk and customer-service ticketing system, are being exploited, and one of them has no fix yet. The Dutch Institute for Vulnerability Disclosure (DIVD) found them while investigating the breach of its own network on 21 September 2026, and published its case on 30 September. The Netherlands' National Cyber Security Centre (NCSC) issued an alert the same day, rating both the chance of abuse and the possible damage as high.

The two flaws

• CVE-2026-102489 is a session-hijack flaw that leads to remote code execution as the zammad user. DIVD says versions 6.3.0 to 6.5.4 are vulnerable. The NCSC describes it as exploitable without logging in. DIVD adds that the flaw is also present in 7.0.0 to 7.1.3 but is not exploitable there because of environment conditions. A fix is available.
• CVE-2026-102490 lets the local zammad user escalate to root. DIVD says it is present in every version of Zammad, including the latest alpha. There is no fix yet; DIVD says Zammad is working on one.

SecurityWeek, reporting on 1 October, gives both flaws a CVSS score of 9.4. Chained, the two give an attacker full control of the server. On 2 October the US Cybersecurity and Infrastructure Security Agency added both to its Known Exploited Vulnerabilities catalogue, giving US federal agencies until 5 October to act. The NCSC says both have been actively exploited since 21 September 2026.

What DIVD and the NCSC advise

DIVD's advice is short: upgrade to Zammad version 7, or take the instance offline. It has published a script that checks Zammad log files for indicators of compromise, and says it is scanning for exposed Zammad instances and notifying their owners. It reported the flaws to Zammad on 24 September and started notifying owners on 26 September.

The NCSC asks administrators to copy the application and network logs before installing the update. If more becomes known about how the second flaw was abused, those logs are how you will tell whether your system was attacked. For the unpatched flaw, it says to contact your supplier.

BleepingComputer, reporting DIVD's account, says the intrusion into DIVD's network was carried out by an AI agent that left explanations of its own decisions behind, which is how DIVD reconstructed the attack.

What Zammad says

Zammad answered on its community forum on 1 October 2026. On CVE-2026-102489 it says exploitation is possible only on Zammad 6.5 and older, because of the runtime those versions use; those versions are out of support and get no security fixes, and Zammad 7.0 and later are not affected. It has still hardened the code, and the change ships in Zammad 7.2.0, the current stable release.

On CVE-2026-102490 Zammad first said it had received no technical details from DIVD and could not confirm the flaw or its scope. Later the same day a Zammad staff member wrote that the details had now arrived, that the company is working on the issue, and that it cannot be exploited remotely on its own: an attacker would already need access to the server. On older versions, CVE-2026-102489 gave attackers exactly that access, which is why the chain was dangerous.

Zammad also criticised the disclosure: by DIVD's own timeline it was told on 24 September, and public scanning and disclosure followed on 26 September.

What to do

• Find every Zammad instance you run, including test and staging copies, and note its version.
• Copy application and network logs first, then update to Zammad 7.2.0, the release Zammad recommends. Anything on 6.5 or older is both vulnerable and out of support. If you cannot update today, take the instance off the internet.
• Run DIVD's log-check script from its case page and treat any hit as a breach: tickets often hold customer personal data and credentials that customers pasted in.
• If a hosting partner runs Zammad for you, ask them in writing which version you are on and when they upgraded.
• Restrict who can reach the server (SSH, admin panels, other services on the same host): the second flaw needs a foothold there first.
• Watch Zammad's security advisories on GitHub for the fix for CVE-2026-102490, and apply it when it arrives.

Sources

• DIVD CSIRT: DIVD-2026-00015, Vulnerabilities in Zammad during investigation of case DIVD-2026-00014 - 30 September 2026
• NCSC (Netherlands): Actief misbruik van zeroday-kwetsbaarheden in Zammad: update nu - 30 September 2026
• BleepingComputer: DIVD says Zammad zero-days enabled AI-driven network breach - 30 September 2026
• SecurityWeek: Zammad zero-days exploited in AI-powered DIVD hack - 1 October 2026
• Zammad community forum: Zammad statement on vulnerability reports in DIVD case DIVD-2026-00015, and staff update - 1 October 2026