---
id: "CVE-2026-102490"
kind: "vulnerability"
aliases: ["CVE-2026-102490"]
title: "Zammad packages built with packager.io (DEB and RPM) could have allowed a local attacker who already had file system\u2026"
severity: "critical"
cvss: 9.4
epss: null
exploited: true
status: "open"
category: "vendor"
products: [{"name": "Zammad GmbH Zammad", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "Zammad", "fixed": ["7.2.2"], "affected": ">= 1.5.0, <= 7.2.1 (DEB/RPM packager.io packages only)", "ecosystem": "vendor"}, {"name": "zammad", "fixed": ["7.2.2"], "affected": "< 7.2.2", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["deb", "exploited", "helpdesk", "linux", "packager-io", "privilege-escalation", "rpm", "self-hosted", "vendor", "zammad"]
not_affected_if: ["container-image", "managed-hosting", "saas", "source-install"]
published_at: "2026-09-30T17:16:40+00:00"
first_seen_at: "2026-10-23T19:11:50+00:00"
updated_at: "2026-10-23T23:44:52+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-102490", "first_seen_at": "2026-10-23T19:11:50+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T21:36:05+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-102490", "first_seen_at": "2026-10-23T23:44:52+00:00"}]
---

# Zammad packages built with packager.io (DEB and RPM) could have allowed a local attacker who already had file system…

Zammad installed from DEB/RPM packages (packager.io) ran services as root and executed files writable by the unprivileged zammad account, so anyone with write access as that account could reach root within seconds (services auto-restart). Local only, but it is chained with CVE-2026-102489 (session hijack to RCE as zammad, Zammad 6.3.0-6.5.4) and was exploited as a zero-day since 2026-09-21. Source installs, official container images and SaaS are not affected. Fixed in Zammad 7.2.2.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Zammad GmbH Zammad affected ? fixed ?
- vendor:Zammad affected >= 1.5.0, <= 7.2.1 (DEB/RPM packager.io packages only) fixed 7.2.2
- vendor:zammad affected < 7.2.2 fixed 7.2.2

## How to check

Only DEB/RPM (packager.io) installs are affected: check the installed package (dpkg -l zammad or rpm -q zammad); any version <= 7.2.1 is affected. On internet-reachable hosts, run DIVD's log-check script from the DIVD-2026-00015 page for IoCs, and treat any host where code ran as the zammad user as compromised.

## Fix

Upgrade the Zammad DEB/RPM package to 7.2.2 or later. Preserve application and network logs before upgrading. Zammad 6.5 and older get no security updates: move to 7.x. Until patched, restrict server access to trusted admins.

## Timeline

- 2026-10-23T19:11:50+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-102490
- 2026-10-23T21:36:05+00:00 analyst — Primary: Zammad GHSA-p97w-927q-8vxq + 7.2.2 release (2026-10-08); DIVD case 00015/00014 confirm exploitation since 2026-09-21 (DIVD itself breached). Zammad's Oct 5 page predates the fix. No public PoC found; X had only 2 posts, skipped.
- 2026-10-23T23:44:52+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-102490

## Documents

- [advisory] GHSA-p97w-927q-8vxq: Local privilege escalation to root in DEB/RPM packages (fixed 7.2.2) https://github.com/zammad/zammad/security/advisories/GHSA-p97w-927q-8vxq
- [advisory] Zammad advisory CVE-2026-102489 & CVE-2026-102490 https://zammad.com/en/advisories/cve-2026-102489-cve-2026-102490
- [describes] DIVD-2026-00015 case page https://csirt.divd.nl/cases/DIVD-2026-00015/
- [describes] DIVD-2026-00014 When, not if (breach via the two Zammad zero-days) https://csirt.divd.nl/cases/DIVD-2026-00014/
- [fix] Zammad 7.2.2 security release https://zammad.com/en/product/releases/7-2-2
- [mentions] Zammad advisory CVE-2026-102489 & CVE-2026-102490 https://zammad.com/en/advisories/cve-2026-102489-cve-2026-102490

## From the sources

Zammad packages built with packager.io (DEB and RPM) could have allowed a local attacker who already had file system write privileges as the unprivileged zammad service account to escalate to full root privileges on the host. Service processes began running as root and executed files that were owned and writable by the zammad account before dropping their identity to that account. An attacker holding that foothold could have escalated within seconds, because the affected services were restarted automatically whenever they stopped; no administrator interaction was required. Only installations from the DEB and RPM packages were affected — installations from source or the official container images were not. All released packaged versions were affected.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_