Zammad's two flaws were chained in seconds by an automated agent, and the second one is about service accounts

CVE-2026-102490 turned application-level code execution into root because the packaged service ran files the service account could write.