# The helpdesk was the case

2026-10-02

CISA listed two Zammad bugs as exploited. The vendor says the remote one bites on 6.5 and older, and that the privilege bug is not a remote door by itself. DIVD, which handled the case, was hit through its own helpdesk.

Canonical: https://www.fabiocti.com/notes/the-helpdesk-was-the-case/
Author: Fabio Correia

The catalog paired two bugs. The vendor’s page does not.

CISA today added CVE-2026-102489 and CVE-2026-102490 to the KEV list and set 5 October as the date for civilian federal agencies. Its description of the first is a session-fixation flaw that can lead to code execution as the zammad user, and that can be chained with the second. Ransomware use is unknown. The CVE record limits practical exploitation of the first bug to Zammad 6.3.0 through 6.5.4. The same flaw exists in 7.0.0 through 7.1.2 and is not exploitable there, because the runtime changed. Zammad’s own post says 6.5 and older are out of support, that 7.0 and later are not affected in practice, and that the hardening is in 7.2.0.

The second bug is the one their forum would not bless on sight. They wrote that DIVD had not yet shown them the details, that they could not confirm scope, and that it cannot be exploited remotely on its own: someone would already need access to the server. They later said the details had arrived and they were working on them. Third-party pages calling it “actively exploited” ran ahead of that confirmation. CISA listed it anyway.

Security Affairs reports the case started because DIVD’s own Zammad was the door, and that an automated agent was part of how fast the two issues were used together. I am not describing that chain.

## What the ticket will flatten

“Two critical KEVs, patch by Monday” will be applied to a 7.1 box and a 6.5 box as if they were the same machine. On 7.1 the remote bug is present and not the way in. On 6.5 it is the way in, and there is no security fix coming inside that major version. The privilege bug, on the vendor’s telling, matters after someone is already on the host. A scanner that only sees the KEV date will not say any of that.

If you run Zammad, the question is the major version, then whether the host was touched, not whether the CVE page looks severe. Update to 7.2.0 if that is the fixed line you can actually install. Do not brief a helpdesk as “internal, so unexposed.” DIVD’s was internal enough to be the case file, and it was still the door.