CVE-2026-102490

Zammad's improper privilege management flaw allows local users to escalate to root, and it is actively exploited in the wild.

A local privilege escalation vulnerability in Zammad lets the zammad user gain root access, which can be chained with a related flaw. DIBs must patch immediately because the flaw is in KEV and actively exploited, indicating attackers are leveraging it for lateral movement or data exfiltration. Failure to patch exposes the entire application stack to full system compromise.

Shame score — The flaw is actively exploited in the wild and allows full root compromise, representing a severe, avoidable negligence in privilege management.