Zammad helpdesk flaws are being exploited: check your version and who can reach it

If your IT shop runs its own Zammad ticketing system, check the version today. On October 2, 2026, the Cybersecurity and Infrastructure Security Agency (CISA) added two Zammad vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, which means attackers are using them now. The deadline CISA set for federal agencies was October 5. Zammad published its own advisory on October 5.

Zammad is open-source helpdesk software. It is also a server that holds ticket history, which often includes passwords, network details, and screenshots people pasted in. That makes a compromised instance worth far more than the ticket system itself.

What the two flaws are

• CVE-2026-102489 is a session fixation flaw, meaning an attacker can trick the application into accepting a login session the attacker controls. The Dutch Institute for Vulnerability Disclosure (DIVD) reports it leads to running code on the server as the low-privileged zammad user. DIVD lists Zammad 6.3.0 through 6.5.4 as vulnerable. It also lists 7.0.0 through 7.1.3 as having the flaw, but Zammad says exploitation is only possible on 6.5 and earlier, and that 7.0 and later are not affected in practice.
• CVE-2026-102490 is a local privilege escalation flaw. Someone who already has the zammad account on the server can become root. DIVD lists versions 1.5.0 through 7.1.0-alpha. Zammad says it can’t be exploited remotely on its own, and as of its October 5 advisory the issue was still under analysis, with a fix being worked on.

Used together, the first gets an attacker onto the server and the second gives them full control. CISA lists both as exploited.

Check whether you’re exposed

1. Find your Zammad version. Ask whoever installed it, or check the version in your Zammad admin settings or release notes for the build you deployed.
2. Find out who can reach it. If the Zammad web address is open to the internet, you are the highest priority. If it is only reachable from the office network or over a VPN, the risk is lower but not gone.
3. Note whether it’s a supported version. Zammad says 6.5 and earlier have been out of support for some time and no longer get security updates. If you are on one of those, there is no patch coming for you.

What to do

1. Move to Zammad 7. Both Zammad and DIVD advise upgrading to version 7. Zammad says a hardening change to the affected code is included in 7.2.0, so go to 7.2.0 or later where you can. Take a backup and a server snapshot first.
2. If you can’t upgrade today, take it off the internet. Put it behind your VPN or a firewall rule limited to your own addresses. DIVD says to take the system offline if you can’t upgrade.
3. Limit who can sign in to the server itself. Zammad’s advice is to restrict access to the underlying server to trusted administrators only. This matters most for the second flaw, since it needs a foothold first.
4. Look for signs of compromise if you were exposed. DIVD has published a log analysis script for its case. Zammad’s advisory doesn’t give indicators of compromise, so if you ran an old version reachable from the internet, treat the server as possibly breached. Change any credentials stored in tickets, and see what to do in the first hour.

Details are as of October 5, 2026. The fix status for CVE-2026-102490 may change, so check Zammad’s advisory again before you consider this closed.

For office managers

If your IT person or provider uses a ticket system called Zammad, ask them to confirm it is on version 7 and not open to the whole internet. You don’t need to do anything else.

Sources

• CISA: Two Known Exploited Vulnerabilities added to the catalog (October 2, 2026) for the KEV listing and federal deadline
• CISA Known Exploited Vulnerabilities Catalog for the entries and due dates
• Zammad security advisory: CVE-2026-102489 and CVE-2026-102490 for the vendor’s assessment, support status, and recommendations
• DIVD case DIVD-2026-00015 for the researchers’ affected version ranges and recommendation