What Happened

Two vulnerabilities in Zammad ticketing system are being actively exploited. CVE-2026-102489 enables session hijacking leading to remote code execution in versions 6.3.0 to 6.5.4. CVE-2026-102490 allows local privilege escalation to root across all versions up to 7.1.3. CISA added both to its Known Exploited Vulnerabilities catalog on October 2, 2026. Reports indicate the exploits are trivial to reproduce.

Who Is Affected

All organizations running Zammad versions below 7.0 are affected, particularly those using versions 6.3.0 to 6.5.4 for the RCE vulnerability. Zammad GmbH, a German software company, is the vendor. Customers in Germany and globally are at risk of unauthorized access to sensitive ticket data and service disruption.

Market Impact

The market impact includes:

• Increased urgency for incident response and patch management services targeting Zammad customers.
• Potential for widespread exploitation given trivial reproduction.
• Opportunity for MDR vendors to offer remediation support.
• Risk of data breaches and compliance issues for affected organizations.

What to Watch

Monitor for further exploitation reports and patches from Zammad. Organizations should prioritize upgrading to version 7.0 or later. Security teams should check for signs of compromise and ensure systems are patched immediately.

Related coverage

• Citrix Releases Emergency Patch for Actively Exploited NetScaler DoS Vulnerability CVE-2026-88779
• GitLab Issues Urgent Patch for Critical AI Gateway RCE Flaw (CVE-2026-90970, CVSS 9.9)
• Critical RCE Vulnerability CVE-2026-18397 Found in Thales SConnect
• Critical FortiMail vulnerability CVE-2026-104286 actively exploited in zero-day attacks