Threat actors have weaponized a devastating two-stage remote exploit chain targeting Zammad, the open-source web-based ticketing system relied upon by thousands of organizations worldwide. By chaining an unauthenticated session fixation defect (CVE-2026-102489) with an improper privilege management vulnerability (CVE-2026-102490), attackers achieve remote, unauthenticated code execution with full root privileges on host servers. CISA cataloged CVE-2026-102490 under emergency remediation directive BOD 26-04.
The Two-Stage Weaponization Chain
The threat campaign executes in two coordinated phases to transition from zero credentials to complete host takeover:
Phase 1: Session Fixation & Admin Account Hijacking (CVE-2026-102489)
In older releases of Zammad (notably 6.5 and earlier), the authentication controller failed to regenerate session tokens upon successful user logon. An attacker pre-seeds a valid session token in an unauthenticated HTTP request. When an administrator subsequently logs into the helpdesk, the backend accepts the attacker's token without issuing a fresh cookie. The attacker then assumes the administrative session, enabling access to system settings, custom hooks, and Ruby background job schedulers.
Phase 2: Local Privilege Escalation to Root (CVE-2026-102490)
Once initial script execution is established within the context of the service account (zammad), the attacker triggers CVE-2026-102490. Due to improper file permissions and misconfigured sudoer delegation scripts used for database backups and service maintenance, the zammad user can overwrite helper wrapper scripts executed by root cron tasks. Within seconds, the attacker spawns an interactive root shell.
Threat Intelligence & Indicators of Compromise
Active intrusions demonstrate threat actors immediately dumping PostgreSQL database credentials, downloading customer communication threads, and harvesting OAuth tokens integrated with Microsoft 365 and Google Workspace.
| Telemetry Indicator | Type | Description & Forensic Signature |
|---|---|---|
/var/log/zammad/production.log |
Log Pattern | Repeated GET requests to /api/v1/sessions with static cookie headers prior to login events |
/tmp/.zammad_svc_cache |
Artifact | Staged ELF binary or reverse shell script spawned by user zammad |
/etc/cron.d/zammad-maintenance |
Persistence | Modified cron entry containing piped bash or netcat connections to external C2 IPs |
Defensive Playbook & Emergency Incident Triage
Security teams operating self-hosted or cloud-hosted Zammad instances must execute immediate containment and verification:
- Immediate Patching: Upgrade all Zammad installations to 7.1.0 or apply the official security hotfixes immediately.
- Audit Active Sessions: Terminate all active web sessions across the database:
zammad run rails r "Session.delete_all" - Inspect Sudoers & Cron Entries: Verify the integrity of
/etc/sudoers.d/zammadand ensure permissions on maintenance scripts are strictly owned byroot:rootwith mode0750. - Rotate Credentials: Given that helpdesks store inbound/outbound SMTP credentials, IMAP passwords, and third-party webhook secrets, all integrated secrets must be rotated following server verification.
