CVE-2026-102489

Zammad Zero-Day Vulnerabilities Exploited

By Editorial Team | October 6, 2026

Two Zammad zero-day vulnerabilities give attackers root on helpdesk servers. Used against DIVD, on CISA KEV, one flaw had no fix at disclosure.

Two Zammad zero-day vulnerabilities, CVE-2026-102489 and CVE-2026-102490, let an attacker take over the open-source helpdesk and reach root on its server. The Dutch Institute for Vulnerability Disclosure (DIVD) says an automated AI agent chained them against its own network on September 21. CISA has added the first flaw to its Known Exploited Vulnerabilities catalog, and…