Zammad privilege escalation to root under active CISA KEV exploitation (CVE-2026-102490)

What happened

CVE-2026-102490 is a privilege-escalation weakness in Zammad. The CVE record describes the local zammad user being able to escalate to root, and states that all versions including the latest alpha are vulnerable. The CVSS 4.0 vector rates the issue 9.4 critical: network attack vector, low complexity, no privileges required, passive user interaction, and high impact to the vulnerable system and subsequent systems.

CISA added the issue to its Known Exploited Vulnerabilities catalog on 2 October 2026 and records exploitation as active. No vendor name, vendor advisory or vendor statements are present in the CVE record.

Who is affected

Zammad 1.5.0 through before 7.1.0-alpha is affected. The fixed release is Zammad 7.1.0-alpha. The CVE record does not narrow this by platform, deployment type or configuration; treat any in-scope Zammad instance as affected.

What to do now

1. Upgrade affected instances to Zammad 7.1.0-alpha, the fixed release listed.
2. Follow CISA's KEV required action and BOD 26-04 guidance; evaluate each asset's internet exposure, and discontinue use if mitigations are unavailable. CISA's KEV due date is 5 October 2026.
3. If you cannot patch immediately, restrict network access to Zammad and segment it from other systems, because the CVSS vector describes the issue as network-reachable.
4. Monitor for unexpected root-level activity by the zammad user. No vendor workaround is listed.

How to detect it

No vendor indicators of compromise are published. Start by identifying internet-facing Zammad instances, because the CVSS vector describes the issue as network-reachable, and monitor for unexpected root-level processes or privilege changes involving the zammad user.

Beyond the patch

Patch first, then close the exposure this kind of flaw leaves behind. Because CISA records active exploitation, Managed Detection & Response can watch for post-exploitation activity on systems that may already be affected. Because the issue is scored as network-reachable, Virtual CISO Services can help review internet exposure and BOD 26-04 alignment before the next CVE.