Two Zammad open-source helpdesk/ticketing flaws, first exposed when the Dutch Institute for Vulnerability Disclosure (DIVD) said they were chained in the AI-driven breach of its own network (case DIVD-2026-00015; BleepingComputer 30 Sep). CVE-2026-102489 (CWE-384 session fixation/hijack) leads to remote code execution as the zammad user; per the NVD record mirrored in GitHub advisory GHSA-xmw5-m2wg-4243 it affects Zammad 6.3.0 to 6.5.4, and the code is also present in 7.0.0 to 7.1.3 but not exploitable there because of environment conditions.

CVE-2026-102490 (CWE-269 improper privilege management, GHSA-hgff-g8g3-4xr8) lets the local zammad user escalate to root; NVD text says all versions including the latest alpha, and DIVD lists 1.5 to 7.1.0-alpha. Both carry CVSS v4 9.4 (Critical) in NVD/GHSA. CISA added both to the Known Exploited Vulnerabilities catalog on 2 October 2026 (US federal due date 5 October).

Zammad's statement (1 Oct, community forum): 102489 is only exploitable on 6.5 and older, which are out of support, and the affected code was hardened in 7.2.0; Zammad says it was given no details of 102490 before public disclosure, criticised DIVD's 24 Sep report / 26 Sep publication timeline, then said later on 1 Oct that it had received the details, is working on a fix, and that 102490 needs existing server access to exploit.

Zammad's advice is to update to 7.2.0 (current stable) and watch its GitHub security advisories for the 102490 fix. Australia: WA Government SOC advisory 20261005001 (5 Oct) rates both Critical and reports no exploitation on WA Government networks so far. Incident context: desk divd-ai-agent-breach-20260924.

UPDATE (7 Oct 2026): Horizon3.ai has published a technical write-up and public exploit code for CVE-2026-102489. Sending {"event":"base"} to the /ws WebSocket endpoint can trigger an error response that leaks the _zammad_session cookies of users connected at that moment, so at least one logged-in user must be online for the attack to work. With an administrator's session, the package installation feature can write files into the application and replace email templates with ERB code, giving code execution as the zammad service account (not root).

Horizon3 is withholding details of the privilege escalation it believes is CVE-2026-102490 because it is still unpatched. DIVD has released a script to look for signs of leaked session cookies in Zammad logs; preserve logs before rebuilding.

Sources: Horizon3.ai (7 Oct), Cyber Security News (8 Oct).

Correction (22 Oct 2026): this card said Zammad had not yet published a fix for CVE-2026-102490 and that it affected all versions.

Zammad's advisory GHSA-p97w-927q-8vxq (8 October) fixes it in 7.2.2 and says only installs from the DEB and RPM (packager.io) packages were affected, not source or official container installs; the CVE record now scores it CVSS 4.0 8.5 on its own (local) and 9.4 for the exploited chain. Horizon3's 7 October remark that it was unpatched predates the fix. (source: Zammad GitHub advisory GHSA-p97w-927q-8vxq)