Kwetsbaarheden aangetroffen in Zammad

Two zero-day vulnerabilities have been discovered in Zammad, an open-source helpdesk/ticketing system. CVE-2026-102489 allows an unauthenticated remote attacker to execute arbitrary code and affects Zammad versions 6.3.0 through 6.5.4. CVE-2026-102490 enables a low-privileged attacker to escalate privileges to root and affects all common versions of Zammad. Both vulnerabilities are being actively exploited in the wild since at least September 21, 2026. The chained exploitation of these two vulnerabilities allows remote attackers to gain root-level access on systems running Zammad. The Dutch NCSC has issued an advisory urging immediate action for organizations running Zammad.