Is CVE-2026-102490 exploited in the wild?

Yes. CVE-2026-102490 is known to be exploited in the wild, first recorded on 2 October 2026. Treat it as urgent.

How severe is CVE-2026-102490?

Critical severity, published 30 September 2026.

Which products and versions are affected?

Zammad all versions including latest alpha.

Is there a fix for CVE-2026-102490?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-102490 attacked?

It is attacked with local access, in a web application.

Am I affected by CVE-2026-102490?

Check whether you run Zammad or Zammad Gmbh Zammad at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-102490: Zammad privilege escalation to root

CVE-2026-102490 · Severity: critical · Exploited in the wild · Published 2026-09-30

Zammad, an open-source customer service ticketing system, contains a privilege escalation vulnerability that allows the local zammad user to gain root access. An attacker with access to the zammad user account on a server can execute arbitrary commands with full system privileges, potentially compromising the entire server and all data it contains.

Technologies: Zammad. Vendors: Zammad.

Quick answers

Is CVE-2026-102490 exploited in the wild?: Yes. CVE-2026-102490 is known to be exploited in the wild, first recorded on 2 October 2026. Treat it as urgent.
How severe is CVE-2026-102490?: Critical severity, published 30 September 2026.
Which products and versions are affected?: Zammad all versions including latest alpha.
Is there a fix for CVE-2026-102490?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-102490 attacked?: It is attacked with local access, in a web application.
Am I affected by CVE-2026-102490?: Check whether you run Zammad or Zammad Gmbh Zammad at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

This privilege escalation vulnerability affects all versions of Zammad and enables the unprivileged zammad service user to escalate privileges to root. The vulnerability requires local access to a zammad user account. Successful exploitation grants an attacker root-level access to the system, allowing full compromise of the server and all application data.

Affected products

Zammad Zammad all versions including latest alpha

Timeline

2026-09-30: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.