Skip to content
COOEY

FAIL › dossier

Zammad

PRODUCT

· dossier confidence 0%

Zammad is an open-source ITSM platform with a critically degraded security posture due to multiple actively exploited vulnerabilities, including privilege escalation and remote code execution flaws affecting all versions.

Failure events
4
Zero-days
0
RCEs
1
On KEV
2
Critical
2
Worst shame
85
PROFILE
Categoryopen-source ITSMWhat they doZammad is an open-source IT service management (ITSM) and customer support platform.
SECURITY POSTURE

Zammad's security posture is critically compromised by multiple actively exploited vulnerabilities, including privilege escalation and remote code execution flaws affecting all versions.

Notable failures
  • CVE-2026-102490: local privilege escalation to root
  • CVE-2026-102489: session fixation RCE
  • CVE-2026-102489: session hijack RCE
Patterns: repeated unpatched RCE and privilege escalation flaws; active exploitation in the wild
FAILURE HISTORY · 6
DATEEVENTSEVSUMMARY
2026-10-02 CVE-2026-102490 high Zammad's improper privilege management flaw allows local users to escalate to root, and it is actively exploited in the wild.
2026-10-02 CVE-2026-102489 high Zammad's session fixation flaw allows remote code execution as the zammad user and is actively exploited in the wild.
2026-09-30 CVE-2026-102489 critical Zammad 6.3.0-6.5.4 and 7.0.0-7.1.3 suffers a session hijack leading to remote code execution as the zammad user.
2026-09-30 CVE-2026-102489 critical Zammad 6.3.0-6.5.4 and 7.0.0-7.1.3 suffers a session hijack leading to remote code execution as the zammad user.
2026-09-30 CVE-2026-102490 critical Zammad allows local users to escalate privileges to root across all versions, including the latest alpha.
2026-09-30 CVE-2026-102490 critical Zammad allows local users to escalate privileges to root across all versions, including the latest alpha.
DOSSIER SOURCES
Open questions: exact founding year · headquarters location
DOSSIER · dex-RAG synthesis · grounded in our own collection + trusted sourcesbuilt 2026-10-06 04:52:54.232837+00:00