Zammad KEV catch-up: DEB and RPM local escalation fixed in 7.2.2
Package format is part of the exposure check. CVE-2026-102490 affects Zammad DEB and RPM packages built with packager.io. DIVD’s CNA record describes an attacker who already has filesystem write privileges as the unprivileged zammad service account escalating to root. It is not remote code execution on its own.
Scope, not slogans
The CNA’s structured range starts at 1.5.0 and ends before 7.2.2; earlier releases are marked unknown. Source installations and official container images are excluded in its description. Do not mark every Zammad deployment vulnerable just because the application name matches.
DIVD assigns CVSS 4.0 8.5 for the general local-escalation scenario. Its separate 9.4 chained scenario includes CVE-2026-102489 and must not be presented as the standalone score for this local flaw. Zammad’s October 5 advisory also distinguishes the local issue from the other CVE and says 7.0 and later are not practically affected by CVE-2026-102489 under their runtime environment.
The later release resolves the older advisory
Zammad’s October 8 release notice identifies 7.2.2 as the security update for the DEB/RPM package privilege escalation. Its October 5 statement that work was ongoing is historical, not evidence there is still no fix. The 7.2.2 notice says SaaS instances are not affected and tells self-hosted administrators to update.
Inventory both installation method and installed package version. Plan the supported package update, verify it completed and review evidence if the service account may have been compromised. A package version is an exposure indicator, not a compromise detector.
CISA added CVE-2026-102490 on October 2 and listed October 5, 2026 as its due date. This is explicitly an older KEV catch-up. No exploit or service-restart attack procedure is included. The sloth verdict: read the package label before grabbing the patch.
