Loading vulnerability…
CVE-2026-102490 is an improper privilege management vulnerability in Zammad that allows an attacker operating as the local zammad service account to escalate privileges to root. Linux and Docker deployments are identified as affected. DIVD describes all versions, including the latest alpha, as vulnerable, while structured version records specify versions from 1.5.0 up to, but excluding, 7.1.0-alpha; the precise affected-version boundary remains unresolved. Technical details of the vulnerable function and exploitation mechanism are not available. The flaw has reportedly been exploited in combination with CVE-2026-102489 to progress from remote code execution as zammad to root access.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
No public exploits tracked yet. Mallory keeps watching.
No public exploit code observed for this vulnerability.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
75 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
An improper privilege management vulnerability allowing a local Zammad user to escalate privileges to root. Zammad confirmed that exploitation requires existing server access and cannot occur remotely on its own. Chaining it with CVE-2026-102489 could enable complete server takeover. CISA added it to its Known Exploited Vulnerabilities catalog on October 2, 2026, with an October 5 remediation deadline. Although CISA lists it as known exploited, the report does not independently establish exploitation of this specific flaw or provide a confirmed affected-version range.
A local privilege escalation vulnerability in Zammad that allows a local user to obtain root privileges, rated CVSS 4.0 9.4 and reported to affect all Zammad versions. Attackers reportedly chained it with CVE-2026-102489 during the September 21, 2026 DIVD breach to obtain root access within seconds. The content describes an attack script and suspected autonomous AI-driven execution, but identifies no named threat actor or malware family.
A reported local privilege-escalation vulnerability in Zammad, exploited in the DIVD breach after CVE-2026-102489 to elevate the compromised zammad account to root. DIVD reports that versions 1.5.0 through the 7.1.0 alpha release are affected. Its CVSS score is 8.5 locally and its chained CVSS-BT score is 9.4. Zammad says it has not received technical details and cannot verify the vulnerability, its scope, or affected versions. Although the vendor recommends upgrading to 7.2.0, the article does not confirm a patch specifically for this vulnerability. Taking affected instances offline and isolating infrastructure are described mitigations.
A reported high-severity local privilege escalation vulnerability in Zammad, rated CVSS 8.5, that allows the local zammad user to obtain root privileges. Reported affected versions are 1.5.0 through 7.1.0-alpha, but the vendor disputes the report and says it lacks technical details to confirm the flaw, scope, or affected releases. The content reports active exploitation and addition to CISA's KEV catalog on October 2, 2026. No official patch has been released according to the content.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.