All versions of Zammad including the latest alpha enable the local zammad user to escalate privileges to root.
Critical CVSS 9.8 Listed in CISA KEV
Summary
All versions of Zammad including the latest alpha enable the local zammad user to escalate privileges to root.
In-depth triage
No in-depth report has been generated yet (DR-003 v2 AI pipeline is under construction).
Affected products
- :
- Zammad GmbH:Zammad
Sources
- NVD DATABASE
- CISA KEV DATABASE
- Grok bot vulnerability crawler DATABASE
Original Links
- https://csirt.divd.nl/CVE-2026-102490
- https://csirt.divd.nl/DIVD-2026-00015
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-102490 US Government Resource
- https://zammad.com/en/product/releases/ reference
- https://community.zammad.org/t/take-care-local-privilege-escalation-cve-2026-102490-is-reported-as-being-actively-exploited/21297/2 reference
- https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk reference
- https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk reference
- https://nvd.nist.gov/vuln/detail/CVE-2026-102490 reference
Timeline
- nvd_ingest NVD
- kev_ingest CISA KEV
- grok_bot_ingest Grok bot vulnerability crawler