Zerodaylekken in ticketsysteem Zammad adhibitum in hack DIVD

Institutum Dutch pro Vulnerability Disclosure (DIVD) nuper hackatum est per duas zerodaylekken in software ad auxilium et systemate ticketorum Zammad, ut ipse declaravit. Centrum National Cyber Security (NCSC) monet quod vulnerabilitates ab 21 Septembris active abutuntur et pro una ex vulnerabilitatibus abutendis nondum update praesto est.

DIVD est fundatio quae auxilio voluntariorum in interreti vulnerabilia systemata perquirit ut implicatas organizationes monere possit. Praeterea securitatis investigationes facit. Nuper DIVD nuntiavit se ab AI-agentibus hackatum esse. Martis fundatio in LinkedIn declaravit quod impetus fieri potuit ob 'vulnerabilitatem technicam'. Ister nocte DIVD nuntiavit AI-agentes duas vulnerabilitates in Zammad adhibuisse. Software ad tractandum tickets, exempli gratia cum clientes quaestiones habent, et ad praebendum auxilium. Super hoc etiam NCSC cum admonitione venit.

Prima vulnerabilitas adgressa CVE-2026-102489 permittit remote code execution per invasorem non authenticatum. Per secundum securitatis lacunam (CVE-2026-102490) invasor qui iam accessum ad systema habet iura sua ad iura root augere potest. CVE-2026-102489 in versionibus 6.3.0 usque ad 6.5.4 praesens est, ut NCSC indicat. Altera securitatis lacuna, CVE-2026-102490, nondum soluta est et in omnibus versionibus Zammad vulgaribus praesens est.

DIVD suadet omnibus organizationibus quae Zammad utuntur ut ad Zammad versionem 7 upgrade faciant vel systema offline tollant. Versio 7 continet CVE-2026-102489, sed lacuna securitatis in hac versione ob circumstantias ambientales non abuti potest. "NCSC suadet ut updates cum celeritate instituantur. Serva applicationis et retis logs antequam haec updates instituas. Talia log data in posteriori tempore necessaria esse possunt ad determinandum utrum tua Zammad-ambitus in zeroday-phasi compromissum sit," sic monet auctoritas publica. DIVD ad se dicit adhuc cum overview de quibus data in impetu compromissa sint venturum esse.

Vulnerabilitates Relatae

CVE-2026-102490 CVSS 9.8 CRITICAL Analyzed

CVE-2026-102490 - Zammad GmbH Zammad Improper Privilege Management Vulnerability - [Actively Exploited]

Zammad packages built with packager.io (DEB and RPM) could have allowed a local attacker who already had file system write privileges as the unprivileged zammad service account to escalate to full root privileges on the host. Service processes began running as root and executed files that were owned and writable by the zammad account before dropping their identity to that account. An attacker holding that foothold could have escalated within seconds, because the affected services were restarted automatically whenever they stopped; no administrator interaction was required. Only installations from the DEB and RPM packages were affected — installations from source or the official container images were not. All released packaged versions were affected.

CVE-2026-102489 CVSS 9.8 CRITICAL Analyzed

CVE-2026-102489 - Zammad GmbH Zammad Session Fixation Vulnerability - [Actively Exploited]

Zammad versions 6.3.0 to 6.5.4 are vulnerable a session hijack vulnerability that leads to remote code execution as the zammad user. The bug is also present in version 7.0.0 to version 7.1.2, but not exploitable due to changes in the underlying framework.

Zerodaylekken in ticketsysteem Zammad adhibitum in hack DIVD

Vulnerabilitates Relatae

Plura ex security.nl