CVE-2026-102490: Zammad GmbH Zammad Improper Privilege Management Vulnerability
Zammad GmbH Zammad contains an improper privilege management vulnerability that can allow the local zammad user to escalate privileges to root. This vulnerability can be chained with CVE-2026-102489.
Overview
Zammad, the open-source helpdesk platform, contains an improper privilege management flaw that allows the local OS user account under which it runs to escalate privileges to root on the host system. Versions 1.5.0 through 7.1.0-alpha on Linux and Docker are affected. DIVD has reported active exploitation, and the flaw can be chained with CVE-2026-102489, which would allow a network-based attacker to first gain code execution as the Zammad user and then reach root without any local access requirement.
Vulnerability details
CWE-269 (Improper Privilege Management) describes a condition where a process or OS-level account is granted more privilege than its function requires, or where the boundary between that account and higher-privilege contexts is not properly enforced. Zammad runs as a dedicated OS user named 'zammad', a common deployment pattern intended to contain the application's blast radius. The flaw breaks that containment: the zammad user can cross the privilege boundary and obtain root on the host, meaning the OS-level isolation that should limit a compromised application process provides no actual protection.
In the standalone scenario, an attacker who already has local access as the zammad OS user can trigger the privilege escalation directly. The specific technical mechanism has not been disclosed by DIVD, and Zammad states it has not received technical details, so the exact vector (misconfigured sudo rule, writable service file, SUID binary, or similar) is unknown. When chained with CVE-2026-102489, a network-reachable attacker with no prior credentials can first exploit that separate flaw to gain execution as the zammad user, then apply this LPE to reach root, yielding full host compromise.
Severity and impact
Exploitation status
This vulnerability is confirmed as actively exploited in the wild — it is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog.
Detection and monitoring
- Review sudoers configuration and SUID/SGID binaries accessible to the zammad OS user. Any entry granting the zammad user passwordless sudo or access to a root-owned binary that was not present at initial deployment is a strong indicator of misconfiguration or tampering.
- Monitor host authentication logs (e.g., /var/log/auth.log or journald) for privilege escalation events originating from the zammad user, specifically su, sudo, or PAM session records showing a transition to UID 0 from the zammad account outside of expected maintenance windows.
- Check process trees on the Zammad host for root-owned processes whose parent is a zammad-user process. A root shell or root-owned service spawned from the Zammad application process is anomalous and warrants immediate investigation.
Remediation
Additional hardening
- Upgrade Zammad to 7.2.0, the current stable release recommended by the vendor for addressing security issues in this disclosure period. Instances running 6.5 or older no longer receive security fixes and should be treated as unpatched.
- Apply the principle of least privilege to the zammad OS account: audit and remove any sudo entries, writable systemd unit files, or SUID binaries accessible to the zammad user that are not strictly required for application operation.
- Restrict host access to the Zammad server to authorized administrators only. Limit SSH access, disable interactive login for the zammad OS user where possible, and ensure no other application or user process shares the zammad account.
- Isolate the Zammad host or container from internal network segments that do not require direct access. Reducing lateral reach limits the impact if root is obtained, and network segmentation also reduces exposure to CVE-2026-102489, which is the chaining entry point.
Key dates
References
- https://zammad.com/en/product/releases/
- https://community.zammad.org/t/take-care-local-privilege-escalation-cve-2026-102490-is-reported-as-being-actively-exploited/21297/2
- https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk
- https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk
- https://nvd.nist.gov/vuln/detail/CVE-2026-102490
- https://csirt.divd.nl/CVE-2026-102490
- https://csirt.divd.nl/DIVD-2026-00015
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-102490
Frequently asked questions
Does CVE-2026-102490 affect my FedRAMP authorization?
If Zammad GmbH Zammad runs inside your authorization boundary, yes. CVE-2026-102490 appears in CISA's Known Exploited Vulnerabilities (KEV) catalog, with a remediation deadline of October 5, 2026. An unpatched KEV inside a FedRAMP authorization boundary is an assessor finding. You must either remediate it or formally document a mitigation before your assessor and sponsoring agency raise it as a deficiency.
How does Knox help me handle CVE-2026-102490?
Knox does not patch Zammad GmbH Zammad on your behalf. Remediation is your responsibility under the FedRAMP shared-responsibility model. What Knox provides is the pre-authorized, single-tenant boundary to remediate within, along with continuous compliance monitoring and audit-artifact coverage that support documentation of the fix for your next assessment. The patch is yours to apply; maintaining a compliant posture while you apply it is not something you carry alone.
How does Knox's monitoring help with vulnerabilities like this?
Knox's automated continuous monitoring platform watches your environment for newly disclosed vulnerabilities and compliance issues, including CVE-2026-102490. Exposure surfaces during ongoing monitoring rather than only when an assessor flags it at review time, giving your team earlier visibility and more time to act.
How do I get FedRAMP authorized with Knox?
Knox runs a FedRAMP-as-a-Service platform. It gives SaaS vendors a pre-authorized cloud boundary on AWS, Azure, and GCP. Your application inherits 60-80% of the required security controls. You reach FedRAMP authorization in about 90 days for roughly 90% less than the traditional $3.5M path. Book a meeting and Knox will map your path to authorization.
What happens if CVE-2026-102490 isn't remediated by October 5, 2026?
An unremediated CVE-2026-102490 becomes a Plan of Action and Milestones (POA&M) item. A growing POA&M list is what turns a routine continuous-monitoring review into a difficult conversation with your sponsoring agency. Closing the item out and keeping your POA&M clean is what preserves both the authorization and the agency relationship.
Ready to achieve FedRAMP authorization in 90 days or less?
Schedule a meeting to discuss scope, parse readiness, and map your company’s accelerated path to FedRAMP authorization.
_Horizontal_RGB.png)
