flawopen.com/Incidents/divd-zammad-ai-agent-zero-day-chain-september-2026

● Dutch Institute for Vulnerability Disclosure (DIVD) · CVE-2026-102489 · 2026-09-21 · CVSS 9.4 · Critical

FlawOpen Security Research

DIVD Zammad Breach: CVE-2026-102489 and 102490

DIVD says attackers reached root through two Zammad vulnerabilities, then used AI agents for further activity. CVE-2026-102490 affects DEB/RPM packages and is fixed in 7.2.2.^{[10], [1], [2], [12], [3], [11]}

💡 Plain English Explainer (ELI5)

Imagine a supervisor who starts with master keys, reads and runs a work order a junior worker can edit, and only then gives up the keys. The worker can change what runs while the supervisor still has full access. Zammad’s package issue concerns files the zammad account can modify before a root-running service drops privileges; an existing foothold is required, and the issue affects DEB/RPM packages. This CVE does not provide initial access.^{[1], [2], [3]}

Core Concepts & Subsystem Terms

CVE-2026-102489: DIVD describes a Zammad session-hijacking issue that leads to remote code execution as the zammad service user. CWE-384 is recorded; GHSA lists 9.4 CVSS 4.0.^{[2], [5], [6]}
CVE-2026-102490: CVE-2026-102490 is a package-specific local privilege-escalation issue. The DEB/RPM service setup can execute files writable by the unprivileged zammad account before the root-running service drops privileges. An attacker therefore needs an existing foothold with relevant write access or code execution. Official containers and source installations are excluded. Zammad 7.2.2 fixes the packaged issue.^{[8], [10], [2], [7], [12], [3], [11]}
CWE-384 / CWE-269: DIVD distinguishes CVSS 4.0 8.5 (local, low privileges) for CVE-2026-102490 alone from 9.4 when chained with CVE-2026-102489. The older GHSA-HGFF record still shows 9.4 with a network/no-privileges vector for CVE-2026-102490 alone. The October 8 Zammad/GHSA-p97 package advisory assigns 8.5 and a local vector to the DEB/RPM issue. Report the scenario and source; do not present the older metadata as proof of standalone remote reachability. For the package-specific issue, GHSA-p97 additionally maps CWE-250, CWE-426, and CWE-732; the CWE-269 mapping in the DIVD/CVE record is a separate attribution.^{[10], [2], [6], [7], [3], [11]}
KEV: NVD marks CVE-2026-102489 as present in CISA’s Known Exploited Vulnerabilities catalog. Do not infer that CVE-2026-102490 is also listed.^[5]
Source disclosure limit: The cited public advisory describes the package issue and fixed version but includes no CVE-specific source lines or patch. This page therefore cannot show a source-backed code fix; follow the vendor’s package guidance instead of treating a generic example as the Zammad patch.^{[6], [7], [11]}

Framework mappings

CWE reference for the weakness described in this guide: CWE-269 CWE-384
CISA KEV — added 2026-10-02 — CVE-2026-102489

Separate Zammad findings and patch status

Finding	Source status and scope	Defender action
`CVE-2026-102489`	DIVD lists 6.3.0–6.5.4 and 7.0.0–7.1.3; the latter range was not exploitable under its reported runtime. Zammad says practical exploitation is limited to 6.5 and earlier and documents additional hardening in 7.2.0.	Assess the exact version and runtime against Zammad and DIVD guidance. The separate 7.2.1 advisory is not evidence that this CVE was fixed there.
`CVE-2026-102490`	The current DIVD record and October 8 Zammad/GHSA-p97 advisory scope this local privilege escalation to DEB/RPM installations; existing access as the unprivileged zammad account is required. The package issue is fixed in 7.2.2; source installs and official containers are excluded. DIVD scores the stand-alone LPE 8.5 local and the chain with `CVE-2026-102489` 9.4. An older GHSA-HGFF record still lists a conflicting network vector for `CVE-2026-102490` alone.	Verify package provenance. Upgrade DEB/RPM installs to 7.2.2 or later; source and official container installs are excluded from this package-specific issue. Keep the stand-alone and chained severity scenarios distinct.
GHSA-23hj-h8w6-rgm3 (separate issue)	This no-CVE advisory covers session-identifier exposure through 7.2.0 and names 7.2.1 as fixed. The cited sources do not map it to either CVE above.	Keep the disclosure separate; do not use its 7.2.1 fix as proof that either DIVD CVE is resolved.

Incident Timeline

2026-09-21

DIVD reports first malicious access to its systems.^[1]

2026-09-22

DIVD detected suspicious activity, blocked access to its datacenter systems, and began incident response with an external forensics team.^[1]

2026-09-24

DIVD says the vulnerability was reported to Zammad.^[2]

2026-09-29

DIVD published its incident case and described the Zammad vulnerabilities.^{[1], [2]}

2026-09-30

CVE-2026-102489 and CVE-2026-102490 were published; DIVD described the linked chain.^{[2], [8], [6], [7]}

2026-10-02

CVE-2026-102489 was added to CISA KEV, according to NVD.^[5]

2026-10-05

Zammad published its assessment: 7.0+ is not practically affected by CVE-2026-102489 under its runtime conditions; CVE-2026-102490 is local and still under analysis.^{[3], [6], [7]}

2026-10-06

Zammad released 7.2.1 for critical security fixes. Its release page does not identify either CVE here; do not assume it resolves CVE-2026-102490.^[4]

2026-10-07

Zammad 7.2.1 links a separate advisory, GHSA-23hj-h8w6-rgm3, for session-identifier exposure fixed in 7.2.1. That advisory lists no CVE; available sources do not map it to CVE-2026-102489 or CVE-2026-102490. Keep the issues separate.^{[4], [9]}

2026-10-08

Zammad released 7.2.2 and linked GHSA-p97w-927q-8vxq to the DEB/RPM-only local privilege-escalation issue assigned CVE-2026-102490. DIVD's current CVE record also lists 7.2.2 as the fixed boundary; source installations and official containers are excluded.^{[10], [11], [12]}

Step-by-Step Attack Flow

Step 1

Initial access was a Zammad zero-day

DIVD reports that an attacker first accessed its systems on September 21, 2026, using a Zammad vulnerability. The public sources do not disclose enough implementation detail to reproduce the vulnerable request safely or accurately.^{[1], [2]}

Step 2

CVE-2026-102489 reached the service account

DIVD describes session hijacking leading to remote code execution as the zammad user. It lists 6.3.0–6.5.4 as affected and 7.0.0–7.1.3 as present but not exploitable under reported environment conditions. Zammad says exploitation is only practical on 6.5 and earlier; its additional hardening is in 7.2.0.^{[2], [3], [6], [5]}

Step 3

A second flaw changed the impact boundary

DIVD says CVE-2026-102490 let the local zammad user reach root in this incident after CVE-2026-102489 provided the earlier foothold. DIVD's current CVE record and the October 8 Zammad/maintainer advisory scope the documented LPE to DEB/RPM package installations; source installs and official containers are excluded. Zammad 7.2.2 fixes this packaged issue. Do not generalize the package-specific precondition to every Zammad deployment.^{[8], [10], [2], [7], [12], [3], [11]}

Step 4

AI agents were used after root access

DIVD says that after the attacker reached root, the actor used AI agents for further activity. This describes what happened after privilege escalation; it is not the mechanism that obtained root. DIVD’s statement does not establish that an AI model independently selected or executed every action.^[1]

Step 5

Patch by CVE and verify evidence

Patch the chain by CVE and deployment type. For CVE-2026-102489, follow Zammad's affected-version/runtime guidance and its 7.2.0 hardening notice. For CVE-2026-102490, verify package provenance: the current advisory covers DEB/RPM installs and names 7.2.2 as fixed; source installs and official containers are excluded from that package issue. Verify the installed build. Preserve the older GHSA's conflicting stand-alone vector as a source discrepancy, not a reachability conclusion.^{[10], [4], [12], [3], [11], [9]}

Why no code pair is shown

The cited public advisory documents the package scope and fixed version but includes no CVE-specific source lines or patch. A code sample here would imply implementation details the source does not show. For affected DEB/RPM packages, verify the supported update to 7.2.2 or later and confirm the installed build.^[11]

Engineering & System Hardening Checklist

✓Inventory exact Zammad edition, version, runtime, and exposure; compare each CVE against its own vendor and DIVD conditions.^{[2], [3], [5], [6], [7]}
✓For CVE-2026-102490, identify how Zammad was installed. Upgrade DEB/RPM package installations to 7.2.2 or later; the Zammad advisory excludes source installs and official container images from this package-specific issue.^{[10], [4], [12], [3], [11]}
✓Track CVE-2026-102490's package-specific fix separately from the earlier GHSA-HGFF metadata; record the installed package type and fixed build, and do not treat its older network vector as proof of stand-alone remote exploitability.^{[7], [4], [12], [3], [11]}
✓Restrict access to the underlying Zammad host to trusted administrators; isolate the service account and remove unnecessary privilege-escalation paths.^{[2], [3]}
✓Segment the help desk from identity, CI, and sensitive data systems; restrict service-account network access to required destinations.^[1]
✓After suspected compromise, preserve logs and forensic images, invalidate sessions, rotate exposed credentials, and review access to connected services.^[1]
✓Use separate status records for “affected,” “not exploitable under stated runtime,” “fixed by vendor,” and “fix deployed”; do not collapse them into one status.^{[3], [4], [8]}