CVE-2026-102490 · Moderate · CISA KEV

Zammad Privilege Escalation: Local User to Root, Chained with Other Vulnerabilities

Threat Engine Auto-Feed · data current as of 2026-10-02

CVE-2026-102490 is an improper privilege management vulnerability in Zammad that allows a local Zammad user to escalate privileges to root. This vulnerability is actively exploited in the wild, as indicated by its inclusion in CISA KEV, and can be chained with other vulnerabilities for greater impact. While EPSS is low, its KEV status warrants immediate attention.

  • CVSS:
  • EPSS percentile: 0.16336
  • Exploitation pressure: 35/100 (Moderate)

Exploitation reality: listed in CISA KEV (exploited in the wild) · EPSS 16th percentile. Threat × Vulnerability from public signals — impact depends on your environment.

Weakness —

Improper Privilege Management means that the software does not correctly restrict or manage the permissions of different users or processes. In this case, a user with limited privileges (a local Zammad user) can exploit this flaw to gain higher-level permissions, specifically root access, which grants full control over the system.

Who's at risk

Exposure: unknown · Auth: unknown · unknown

Enterprise profiles most at risk

  • Organizations using Zammad for customer support or internal ticketing systems
  • Enterprises where Zammad instances are accessible by multiple local users
  • Organizations in Financial Services and Technology sectors, given assessed adversary targeting

Misconfigurations that escalate it

  • Lack of robust endpoint detection and response (EDR) on Zammad host systems
  • Insufficient monitoring for unusual process activity or privilege changes on Zammad servers
  • Failure to promptly apply security updates to Zammad installations

High-impact scenarios

  • An attacker gaining full root control over the Zammad server, leading to data exfiltration or system compromise.
  • Chaining this vulnerability with other flaws (e.g., CVE-2026-102489) to achieve broader system compromise or network access.
  • Compromise of sensitive customer or internal data managed within the Zammad system.

Likely adversaries

  • FIN7 — Financial services (Assessed)
  • LockBit affiliates — Financial services (Assessed)
  • APT38 (Lazarus) — Financial services (Assessed)
  • APT29 (Cozy Bear) — Technology (Assessed)
  • Scattered Spider — Technology (Assessed)

What to do (defensive)

Detect

  • Monitor Zammad server logs for unusual privilege escalation attempts or unauthorized root access.
  • Implement endpoint detection and response (EDR) solutions on Zammad host systems to detect suspicious process execution or file modifications.
  • Regularly audit user accounts and permissions within Zammad and on the underlying operating system for anomalies.

Contain

  • Isolate affected Zammad instances from the network if compromise is suspected.
  • Revoke or reset credentials for any potentially compromised local Zammad user accounts.
  • Perform forensic analysis on Zammad host systems to identify the extent of compromise.

Patch

  • Apply the latest security patches and updates released by Zammad GmbH immediately.
  • Consult Zammad GmbH's official security advisories for specific remediation steps related to CVE-2026-102490.

Frontier verdict — Moderate

This vulnerability is critical due to its inclusion in CISA KEV, indicating active exploitation in the wild, and allows a local Zammad user to escalate privileges to root, posing a significant risk to Zammad deployments.

For detection-engineering and awareness only · point-in-time · not security advice · sourced from NVD, FIRST EPSS, CISA KEV. Adversary mappings are assessments unless cited.