CVE-2026-102490: Zammad GmbH Zammad Improper Privilege Management Vulnerability

Tech Times describes CVE-2026-102490 as a flaw that lets an attacker who already has code execution as the Zammad service user "escalate from that low-privilege account to root on the host system."[2] The outlet reports that it affects all Zammad versions from 1.5.0 through 7.1.0-alpha[2].Infosecurity Magazine reports that the attack on DIVD used this flaw together with the remote code execution bug CVE-2026-102489, and that the pair carry a CVSS score of 9.4 when chained[3]. The vulnerability tracker Hol, however, lists CVE-2026-102490 as High severity (CVSS 8.5)[4].DIVD told Infosecurity Magazine that the attackers could "escalate privileges from the Zammad user to root, in seconds, due to the agentic part of this hack."[3] According to Tech Times, the AI agent decided its own next step after every action, without human direction[2].DIVD said it "was able to stop the attackers from going deeper"[3] because of network segmentation and its incident response team, Infosecurity Magazine reports.Tech Times notes that upgrading to version 7 does not patch CVE-2026-102490[2]. It also reports that Zammad GmbH is working on a fix[2].According to Tech Times, the Dutch NCSC advises making a copy of your application and network logs before installing the update[2]. DIVD told Infosecurity Magazine: "We urge everyone using any version of Zammad to update to version 7 or take it offline"[3].