Zammad: Mehrere Schwachstellen ermöglichen Ausführen von beliebigem Programmcode und Privilegieneskalation
WID-SEC-2026-3694 · first 01.10.2026 · updated 09.10.2026 · CVSS 9,6
What it is about
Zammad ist ein Helpdesk- und Ticketsystem. Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Zammad ausnutzen, um beliebigen Programmcode mit Benutzerrechten auszuführen und um Root-Rechte zu erlangen.
Under what conditions?
Over the network and without logging in. This is the most dangerous combination: attackers can scan reachable devices automatically.
What can happen in the worst case
An attacker could use the vulnerability to
- beliebigen Programmcode mit Benutzerrechten auszuführen
- Root-Rechte zu erlangen
Am I affected?
Affected according to the BSI:
- Zammad Zammad <=7.1.3
- Zammad Zammad <7.1.0-alpha
- Zammad Zammad <7.2.2
The installed version is usually shown under “Help → About” or in the device’s admin interface.
What helps?
Update to at least:
- Zammad Zammad <=7.1.3
- Zammad Zammad 7.1.0-alpha
- Zammad Zammad 7.2.2
Is the vulnerability already being exploited?
- CVE-2026-102490: exploited in the wild according to CISA, in the catalogue since 02.10.2026.
- CVE-2026-102489: exploited in the wild according to CISA, in the catalogue since 02.10.2026.
Information and sources
- Original BSI advisory (WID)
- GitHub Advisory Database vom 2026-09-30 github.com
- GitHub Advisory Database vom 2026-09-30 github.com
- Zammad 7.2.2 Release Notes vom 2026-10-08 zammad.com
CVE: CVE-2026-102489, CVE-2026-102490
Source: BSI warning and information service (CERT-Bund); CISA. The assessment of the conditions is my reading of the BSI text; the external pages are in their original language.