Security1 hOctober 18, 2026, 17:40

Zammad CVE-2026-102490 chain gives attackers root access

Zammad is affected by a two-stage exploit chain: CVE-2026-102489 provides unauthenticated RCE as the zammad user, and CVE-2026-102490 escalates privileges to root. The pair is rated 9.4 Critical on CVSS 4.0 and flagged as exploited in the wild; versions 1.5.0 through 7.1.0 alpha are affected.

DEV Community

Open source

CVE-2026-102490 escalates from zammad to root, scored 8.5 alone
Combined chain rated 9.4 Critical and already exploited in the wild
Affects Zammad 1.5.0 through 7.1.0 alpha on Linux and Docker
ZoomEye matched 11,977 instances running Zammad

#Zammad

Attacker chains three Ivanti Connect Secure zero-days for root access

Security

AI agent chained two zero-days to root DIVD in seconds

Security

Working exploit published for pre-auth AnyDesk Linux flaw giving root access

Security

Zammad CVE-2026-102490 chain gives attackers root access

Attacker chains three Ivanti Connect Secure zero-days for root access

AI agent chained two zero-days to root DIVD in seconds

Working exploit published for pre-auth AnyDesk Linux flaw giving root access

SonicWall SMA1000 Command Injection CVE-2026-83549 Chained to Root