Two Zammad flaws chained to root by an autonomous agent

The Dutch Institute for Vulnerability Disclosure (DIVD) disclosed it was compromised via two critical Zammad flaws, CVE-2026-102489 and CVE-2026-102490, both rated 9.4 under CVSS 4.0. The first enables remote code execution as the zammad service user; the second escalates to root because packager.io packages started as root and executed files writable by that account.

• CVE-2026-102489: session hijack in Zammad 6.3.0–6.5.4 leads to RCE as the zammad user
• CVE-2026-102490: root-started processes executed files writable by the service account
• Both flaws scored 9.4 under CVSS 4.0
• DIVD found the compromise the day after it began