# CISA adds two Zammad vulnerabilities to KEV: CVE-2026-102489 (session fixation to RCE) and CVE-2026-102490 (local privilege escalation to root), chained in an agentic-AI attack on DIVD

> On 2026-10-02 CISA added CVE-2026-102489 (session fixation leading to RCE as the zammad user) and CVE-2026-102490 (zammad-to-root privilege escalation) in Zammad to the KEV catalog. The two flaws were chained as zero-days on 2026-09-21 to breach the Dutch Institute for Vulnerability Disclosure (DIVD), in what DIVD describes as an agentic AI-powered attack.

- **Published:** 2026-10-02T00:00:00Z
- **Last reviewed:** 2026-10-09T07:43:53.235Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2843
- **ID:** TL-2026-2843
- **Severity:** CRITICAL (CVSS 9.8)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 29 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-102489, CVE-2026-102490

## Description

Zammad is an open-source web helpdesk and ticketing system. CVE-2026-102489 is a session fixation / session hijack flaw (CWE-384) in Zammad 6.3.0 through 6.5.4 that leads to remote code execution as the local zammad OS user. Versions 7.0.0 through 7.1.3 contain the defect but, per DIVD and the vendor, are not practically exploitable because of the runtime environment those releases use; the vendor states exploitation is only possible on Zammad 6.5 and older and that the issue is addressed in 7.2.0. CVE-2026-102490 (CWE-269, improper privilege management) lets the local zammad user escalate to root and is reported to affect Zammad 1.5.0 through 7.1.0-alpha on Linux and Docker. It cannot be exploited remotely on its own, but CISA's KEV entries state each can be chained with the other, turning an unauthenticated network attack into full operating-system compromise.

Both flaws were exploited as zero-days against DIVD's own Zammad instance. Initial malicious access occurred on 2026-09-21; DIVD detected the activity on 2026-09-22, blocked access, and engaged Merlon Security for forensics. DIVD reproduced the issues within about 24 hours during case DIVD-2026-00014 (the breach) and opened DIVD-2026-00015 (the Zammad vulnerabilities) for victim notification. DIVD reports the progression from session hijack to root took seconds and attributes the speed and behaviour to an autonomous AI agent: attack logs and scripts contained self-justifying comments, the agent decided each next step itself, and it polluted its own man-in-the-middle attempt with password spraying. Reported data exposure includes DIVD volunteer email addresses and possibly contact details; network segmentation reportedly contained the attacker and prevented persistent footholds. No attacker IPs, domains, hashes or user agents have been published.

There is a vendor/researcher dispute: Zammad states DIVD has not provided technical details for CVE-2026-102490, objects to the disclosure timeline, and as of its 2026-10-01 statement and the runZero write-up no official patch was announced for CVE-2026-102490, while one secondary source claims it is fixed from 7.1.0-alpha onward; treat the fix status of CVE-2026-102490 as unconfirmed. CVSS values vary by source: NVD lists 9.8 (v3.1) and 9.4 (v4.0) for both CVEs, while runZero cites 8.7 and 8.5 (CVSS v4) for the individual flaws and 9.4 for the chain. CISA marks Known Ransomware Campaign Use as Unknown, requires forensic triage, and set a due date of 2026-10-05 under BOD 26-04.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1059 Command and Scripting Interpreter
- T1557 Adversary-in-the-Middle
- T1110.003 Brute Force: Password Spraying
- T1213 Data from Information Repositories
- T1021 Remote Services
- T1068 Exploitation for Privilege Escalation
- T1550.004 Use Alternate Authentication Material: Web Session Cookie
- T1539 Steal Web Session Cookie
- T1059.004 Command and Scripting Interpreter: Unix Shell
- T1548 Abuse Elevation Control Mechanism
- T1070 Indicator Removal
- T1552.001 Unsecured Credentials: Credentials In Files
- T1083 File and Directory Discovery
- T1087 Account Discovery
- T1005 Data from Local System
- T1041 Exfiltration Over C2 Channel

## Sources

- [CISA Adds Two Known Exploited Vulnerabilities to Catalog](https://www.cisa.gov/news-events/alerts/2026/10/02/cisa-adds-two-known-exploited-vulnerabilities-catalog)
- [CISA Known Exploited Vulnerabilities Catalog (JSON feed)](https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json)
- [DIVD-2026-00015 - Vulnerabilities in Zammad during investigation of case DIVD-2026-00014](https://csirt.divd.nl/cases/DIVD-2026-00015/)
- [DIVD-2026-00014 - DIVD incident case](https://csirt.divd.nl/cases/DIVD-2026-00014/)
- [NVD - CVE-2026-102489](https://nvd.nist.gov/vuln/detail/CVE-2026-102489)
- [NVD - CVE-2026-102490](https://nvd.nist.gov/vuln/detail/CVE-2026-102490)
- [Zammad community: Take care - Local Privilege Escalation (CVE-2026-102490) is reported as being actively exploited](https://community.zammad.org/t/take-care-local-privilege-escalation-cve-2026-102490-is-reported-as-being-actively-exploited/21297/2)
- [runZero: Zammad vulnerabilities - Find impacted installations](https://www.runzero.com/blog/zammad/)
- [SecurityOnline: Zammad Zero-Day Chain CVE-2026-102489 Exploited in the Wild in AI-Driven DIVD Breach](https://securityonline.info/zammad-zero-day-cve-2026-102489/)
- [Cybersecurity News: Zammad 0-Day Vulnerabilities Exploited to Gain Remote Code Execution and Root Access](https://cybersecuritynews.com/zammad-0-day-vulnerabilities-exploited/)
- [Forkast: An Autonomous AI Agent Just Breached a Vulnerability Disclosure Nonprofit by Chaining Two Zammad Zero-Days](https://forkast.news/an-autonomous-ai-agent-just-breached-a-vulnerability-disclosure-nonprofit-by-chaining-two-zammad-zero-days/)
- [HOL: Zammad session fixation to root hits CISA KEV](https://hol.org/blog/cve-2026-102489-zammad-session-fixation-rce-kev)
- [Zammad Security Advisories](https://zammad.com/en/advisories)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2843