Zammad privilege escalation lets local zammad user escalate to root (CVE-2026-102490)

What happened

The CVE record describes a privilege escalation in Zammad. In plain terms, the local operating-system account zammad can be used to obtain root on the host. The CVSS 4.0 score is 9.4, severity critical. The vector's meaning is that the issue is reachable over a network, has low attack complexity, requires no privileges, involves passive user interaction, and has high impact to confidentiality, integrity and availability for both the affected and subsequent systems. The written description attributes the escalation specifically to the local zammad user.

CISA's Known Exploited Vulnerabilities catalog added this CVE on 2 October 2026 and records active exploitation. CISA's SSVC assessment also rates exploitation as active. The CVE record does not publicly disclose exploit details, and no vendor advisory is listed.

Who is affected

Zammad versions 1.5.0 to before 7.1.0-alpha are listed as affected. The CVE description says all versions of Zammad, including the latest alpha, enable the flaw. The record names Zammad 7.1.0-alpha as the fixed release.

What to do now

1. Upgrade affected Zammad instances to Zammad 7.1.0-alpha, the fixed release named in the CVE record.
2. Apply the CISA KEV required action, including CISA's BOD 26-04 guidance and CISA's Forensics Triage Requirements. The KEV due date is 5 October 2026.
3. If the upgrade or required mitigations cannot be applied, follow CISA's instruction and discontinue use of the product rather than leave it running.
4. Restrict network exposure of Zammad hosts and monitor the local zammad user until the upgrade is confirmed.

How to detect it

No indicators of compromise are included in the CVE record. Because the flaw gives the local zammad user root, investigate unexpected root-owned processes, new privileged accounts, or changes to sudo and authentication files on Zammad hosts. Prioritise hosts where the zammad service account has executed commands as root.

Beyond the patch

Because CISA KEV and CISA SSVC both record active exploitation, detection and response matter as much as patching. Managed Detection & Response (MDR) can monitor for the post-exploitation activity that follows a root escalation, and an Incident Response Retainer provides a named team if a Zammad host has already been compromised. Since the CVSS vector describes network reachability, Virtual CISO Services (vCISO) can help assess whether your Zammad instance is exposed and what compensating controls to put in place.