Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.4
CVE-2026-102489: Zammad can let attackers hijack sessions and run code
CVE-2026-102489 · published 19 days ago · actively exploited
Summary
The Zammad help‑desk system lets a user’s session be taken over by an attacker, who can then run commands on the server as the Zammad service account. This could let the attacker control the system remotely. Update Zammad to the latest version or apply the vendor’s security patch as soon as possible.
What to do
- Update zammad gmbh zammad to version 6.5.4 or later.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| zammad gmbh | zammad | < 6.5.4 |
| zammad | zammad |
>= 6.3.0, < 6.5.4 >= 7.0.0, <= 7.1.3 cpe:2.3:a:zammad:zammad:*:*:*:*:*:*:*:* |
Original advisory text
Zammad GmbH Zammad Session Fixation Vulnerability
Zammad GmbH Zammad contains a session fixation vulnerability that can lead to remote code execution as the zammad user. This vulnerability can be chained with CVE-2026-102490.
References
- https://community.zammad.org/t/take-care-local-privilege-escalation-cve-2026-102... technical-description
- https://zammad.com/en/advisories/cve-2026-102489-cve-2026-102490 vendor-advisory
- https://csirt.divd.nl/DIVD-2026-00015 third-party-advisory
- https://csirt.divd.nl/CVE-2026-102489 third-party-advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-... US Government Resource
Internet-facing
3 days
and check for signs of compromise
Internal
14 days
- Known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker full control
Severity
9.4
Critical
Known exploited
Listed in the CISA KEV catalogue - exploitation confirmed in the wild.
1%
chance of attack within 30 days
Type
CWE-384Session Fixation
Timeline
Published30 Sep 2026
Updated19 Oct 2026
First seen30 Sep 2026
Track software like this
Free during beta