CVE Alert: CVE-2026-102490 – Zammad GmbH

All versions of Zammad including the latest alpha enable the local zammad user to escalate privileges to root.

**Risk verdict:** Urgently investigate and remediate: exploitation is marked active, and a network-reachable chain may turn a local privilege escalation into a route to full system compromise.

**Why this matters:** Root access can expose ticket contents and credentials, enable tampering with support workflows, and disrupt service. Attackers could use a compromised helpdesk host to pursue sensitive data or establish persistence; downstream impact is possible when chained with the related network flaw.

**Most likely attack path:** On its own, exploitation requires a local foothold with low privileges, but no user action or unusual conditions. In the chained scenario, network access and passive user interaction may provide the initial route; the reported scope impacts indicate potential effects beyond the application host.

**Who is most exposed:** Prioritise internet-facing or business-critical helpdesk deployments, especially self-managed Linux hosts and Docker installations with access to internal networks or identity systems.

Review process, service, and file-permission changes involving the application account and root.

Hunt for unexpected privileged shells, commands, scheduled tasks, or modified startup configuration.

Correlate suspicious helpdesk access or user interaction with subsequent host-level activity.

Check for unusual outbound connections and access to secrets or internal services from the host.

Mitigation and prioritisation

Apply the vendor’s fixed release as soon as available; verify the remediation covers the affected host and container images.

Until patched, restrict access to the application and isolate its host from sensitive internal systems.

Review and rotate potentially exposed credentials after containment; preserve logs and investigate for prior compromise.

Use a tested change window for upgrades, but do not defer remediation without an approved risk exception.

A considerable amount of time and effort goes into maintaining this website, creating backend automation and creating new features and content for you to make actionable intelligence decisions. Everyone that supports the site helps enable new functionality.

If you like the site, please support us on Patreon or Buy Me A Coffee using the buttons below.