Local privilege escalation in Zammad v1.5.0 to v7.2.2 installed via DEB or RPM package
Affects Zammad installed from the DEB or RPM packages, versions 1.5.0 through 7.2.1. Fixed in 7.2.2.
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Listed in CISA KEV
- How many real-world setups can hit the bug, from the vendor's advisory and CISA data. It does not know your setup.What do these mean? →
- Actively exploited
- Fix
- Fixed in 7.2.2
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
- Exploitation: active
- Automatable: no
- Technical impact: total
Summary
Zammad, a web-based helpdesk and ticketing application, is affected when installed from its DEB or RPM packages. A local attacker who already had write access as the unprivileged zammad service account could escalate to full root control of the host, without any administrator action.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
Zammad packages built with packager.io (DEB and RPM) could have allowed a local attacker who already had file system write privileges as the unprivileged zammad service account to escalate to full root privileges on the host. Service processes began running as root and executed files that were owned and writable by the zammad account before dropping their identity to that account. An attacker holding that foothold could have escalated within seconds, because the affected services were restarted automatically whenever they stopped; no administrator interaction was required. Only installations from the DEB and RPM packages were affected — installations from source or the official container images were not. All released packaged versions were affected.
Timeline
- CVE published
- CISA SSVC assessment
Exploitation: active · Automatable: no · Technical impact: total
- Added to CISA KEV
CISA has evidence of exploitation in the wild
- CISA remediation deadline
Due date for US federal agencies to patch
- Record last updated
- EPSS reached 10%
FIRST estimates at least a 10% chance of exploitation in the next 30 days
Affected versions
- Zammad GmbH Zammad
From 1.5.0 · fixed in 7.2.2
References 4
csirt.divd.nl
GitHub · zammad/zammad
Questions about CVE-2026-102490
What does this mean?
A local user who is logged in can gain full root privileges on the host by escalating from the unprivileged zammad service account. The attacker needs local access to the machine first.Source: github.com
Am I affected, and how do I check?
Only installations from the DEB and RPM packages built with packager.io were affected, covering all released packaged versions up to and including 7.2.1. To check, confirm whether Zammad was installed from one of those packages and which version is installed.Source: github.com
What should I do about it?
Upgrade to Zammad 7.2.2, the fixed version. No workaround is listed in the facts for this issue.Source: github.com
Is it being exploited?
Yes. CISA added it to its Known Exploited Vulnerabilities catalog on 2026-10-02, which means it has evidence of attacks. No public exploit code is tracked.Source: cisa.gov, cve.now feed data