CVE-2026-102490Vulnerability

1. “According to Horizon3.ai and Sysdig, CVE-2026-102489 is a remote code execution flaw affecting versions 6.3.0 to 6.5.4, while CVE-2026-102490 is a local privilege escalation (LPE) flaw affecting all versions from 1.5.0 to 7.1.0-alpha.”

   The Hacker NewsNews12 Oct 2026
   ⚡ Weekly Recap: Helpdesk 0-Days, Rogue Certs, ShinyHunters Arrest, AI-Fooling Malware and More

2. “DIVD reports that attackers chained this vulnerability with CVE-2026-102490 to escalate privileges to root.”

   Horizon3.aiVendor8 Oct 2026
   CVE-2026-102489 | Technical Details

3. “CVE-2026-102490 – A privilege escalation that allows escalating to root”

   Horizon3.aiVendor7 Oct 2026
   Zammad CVE-2026-102489: Session Leak to RCE

4. “…4, CVE-2026-102105, CVE-2026-102106, CVE-2026-102115, CVE-2026-102095, CVE-2026-85066, CVE-2026-85065 (Kiteworks), CVE-2026-102489, CVE-2026-102490 (Zammad), CVE-2026-63292, CVE-2026-42356, CVE-2026-42528 (Apache HTTP Server), CVE-2026-101898, CVE-2026-101901, CVE-2026-101909, CV…”

   The Hacker NewsNews5 Oct 2026
   ⚡ Weekly Recap: NetScaler and FortiMail 0-Days, AI Coding Leaks, Spectre v2 and Ransomware Arrests

5. “CVE-2026-102490”

   CERT-FRGovernment5 Oct 2026
   Bulletin d'actualité CERTFR-2026-ACT-042 (05 octobre 2026)

6. “CVE-2026-102490 (CVSS score of 9.4) Zammad GmbH Zammad Improper Privilege Management Vulnerability”

   Security AffairsNews2 Oct 2026
   U.S. CISA adds Zammad GmbH Zammad flaws to its Known Exploited Vulnerabilities catalog

7. “CVE-2026-102490 Zammad GmbH Zammad Improper Privilege Management Vulnerability”

   CISA advisoriesGovernment2 Oct 2026
   CISA Adds Two Known Exploited Vulnerabilities to Catalog

8. “The vulnerabilities exploited in the attack are remote code execution bug CVE-2026-102489 and elevation of privileges flaw CVE-2026-102490, both of which have a CVSS score of 9.4 when chained.”

   Infosecurity MagazineNews2 Oct 2026
   Two Zero-Days Exploited in Attack on Dutch Institute for Vulnerability Disclosure

9. “They are CVE-2026-102489 and CVE-2026-102490, and both bugs received CVSS 4.0 scores of 9.4, when assessed in the chained attack scenario.”

   The Register (security)News1 Oct 2026
   AI agents hacked the hackers, stealing email addresses from security research org

10. “Two zero-day vulnerabilities in the open-source Zammad ticketing system, CVE-2026-102489 and CVE-2026-102490, have been chained by threat actors to break into the Dutch Institute for Vulnerability Disclosure (DIVD).”

    The Hacker NewsNews1 Oct 2026
    ThreatsDay: AI-Powered Zero-Day Chain, 543K Live Secrets, Model Inspection RCE and 13 More Stories

11. “CVE-2026-102490, a privilege elevation vulnerability, allows authenticated attackers with low privileges (the local zammad user) to achieve root on the vulnerable system.”

    Help Net SecurityNews1 Oct 2026
    AI agent used Zammad zero-days to breach Dutch vulnerability disclosure non-profit

12. “The second, CVE-2026-102490 (CVSS score of 9.4), allows a local user to elevate their privileges to root.”

    SecurityWeekNews1 Oct 2026
    Zammad Zero-Days Exploited in AI-Powered DIVD Hack

13. “Working with Merlon Security, DIVD identified two previously unknown vulnerabilities, tracked as CVE-2026-102489 and CVE-2026-102490.”

    Security AffairsNews1 Oct 2026
    AI Agent Chains Zammad Zero-Days To Take Over DIVD Systems in Seconds

14. “De tweede kwetsbaarheid heeft het kenmerk CVE-2026-102490 toegekend gekregen.”

    NCSC-NL advisoriesGovernment30 Sep 2026
    NCSC-2026-0396 [1.00] [H/H] Kwetsbaarheden aangetroffen in Zammad

• csirt.divd[.]nlin 2 reports
• www.moxa[.]comin 1 report

Also named with it: CVE-2026-102489, CVE-2026-89078, CVE-2026-93577, CVE-2026-102331, CVE-2026-76504, CVE-2026-104286, CVE-2026-88779, CVE-2026-81963, CVE-2026-81578, CVE-2026-82078, CVE-2026-73581, CVE-2026-75973, CVE-2026-76183, CVE-2026-77791, CVE-2026-78383, CVE-2026-78437, CVE-2026-79677, CVE-2026-86248