CVE-2026-102490: Zammad GmbH Zammad Improper Privilege Management Vulnerability

Tech Times reports that CVE-2026-102490 is a local privilege escalation flaw that lets an attacker who has code execution as the Zammad service user "escalate from that low-privilege account to root on the host system."[2]According to Security.NL, DIVD said AI agents had used two vulnerabilities in Zammad.[1] The second is CVE-2026-102489, which Security.NL says allows remote code execution by an attacker who is not logged in.[1]The HOL Blog reports that CISA added CVE-2026-102489 and CVE-2026-102490 to its Known Exploited Vulnerabilities catalog on October 2[3], and that CISA notes the two can be chained.[3] According to the same blog, the KEV due date is 2026-10-05.[3]The HOL Blog says DIVD rates CVE-2026-102490 at a CVSS 4.0 base score of 8.5 (High)[3]. Strix lists the flaw as critical-severity, rated 9.4/10.[4]The HOL Blog reports that Zammad's community thread says the company received technical details from DIVD, is working on a fix, and that the issue cannot be exploited remotely on its own.[3]Tech Times reports that upgrading to version 7 does not patch CVE-2026-102490[2], and that DIVD advises upgrading to version 7, running its IoC log-check script and watching for a follow-up patch from Zammad GmbH.[2]According to Tech Times, the Dutch NCSC advises copying application and network logs before installing the update[2].