CISA Warns of Active Exploitation in Zammad Ticketing System

TL;DR

• A critical privilege management vulnerability in Zammad allows local users to escalate their privileges to root on host systems [^1].
• CISA added the flaw to its active exploit catalog, warning that attackers are chaining it with other vulnerabilities in the wild [^2].

Background

Zammad is an open-source helpdesk and customer support platform used by organizations to manage user inquiries, support tickets, and internal communications. Because it handles sensitive client data and integrates directly with email servers, databases, and active directory systems, the platform requires robust security boundaries. If an attacker gains access to the underlying server hosting the application, the consequences can quickly escalate from a localized application breach to a complete network compromise.

What happened

On October 2, 2026, details emerged regarding CVE-2026-102490, an improper privilege management vulnerability in Zammad [^1]. The flaw resides in how the application manages permissions for its local system user account, named zammad. Under specific configurations, this local user can bypass standard operating system restrictions and execute arbitrary commands with administrative root privileges [^1]. This level of access effectively grants total control over the host operating system.

Security researchers discovered that this vulnerability becomes significantly more dangerous when combined with another flaw, tracked as CVE-2026-102489. Although the details of the companion vulnerability point to an initial access vector, the combination allows remote, unauthenticated attackers to first gain a foothold as the low-privileged zammad user, and then immediately execute CVE-2026-102490 to elevate their access to root. This multi-stage attack chain bypasses the defense-in-depth measures designed to contain application compromises.

Due to active exploitation in the wild, the Cybersecurity and Infrastructure Security Agency (CISA) added the vulnerability to its Known Exploited Vulnerabilities catalog [^2]. This designation mandates that federal agencies secure their installations immediately, while urging private organizations to audit their Zammad instances. The active exploitation indicates that threat actors are targeting customer service portals, which often contain rich repositories of internal corporate knowledge, credential dumps, and direct access pathways into private enterprise networks.

Why it matters

The exploitation of CVE-2026-102490 highlights a critical weakness in modern application deployment: the failure of internal privilege boundaries. Many organizations assume that containerization or running applications under dedicated service accounts provides sufficient isolation. However, if the application user can easily escape its sandbox and seize root permissions, the initial containment strategy fails completely. Once an attacker obtains root access on a ticketing server, they can access database credentials, read unencrypted customer correspondence, and install persistent backdoors that survive system reboots.

Furthermore, the chaining of CVE-2026-102489 and CVE-2026-102490 underscores the reality of modern cyberattacks. Sophisticated threat actors rarely rely on a single, all-powerful exploit. Instead, they assemble chains of lower-severity vulnerabilities to achieve their goals. An initial bug might only allow an attacker to read a configuration file or execute low-privileged commands, but when combined with a local privilege escalation flaw, it becomes a catastrophic security event. Organizations must focus on securing internal boundaries just as heavily as they secure external-facing perimeters.

Practical example

Imagine an IT administrator, Alex, who hosts a Zammad helpdesk on a Linux server. An external attacker discovers the server and exploits a separate web bug to execute commands as the low-privileged zammad system user. At this stage, the attacker cannot access the wider operating system or modify core system configurations because of permission blocks.

However, the attacker runs a script exploiting CVE-2026-102490. Because of the improper privilege management flaw, the server misinterprets the command execution request. Within seconds, the attacker's permissions elevate from the restricted zammad account to the unrestricted root administrator. The attacker now overrides system logs, installs a hidden backdoor, and begins scanning Alex’s internal corporate network for further targets, all while disguised as a legitimate system process.

Related gear

We recommend this book because it provides an excellent foundation in Linux file permissions and system administration, helping you understand how local privilege escalation attacks succeed.