CVE-2026-102489

Published Sep 30, 2026

Last updated 8 days ago

Zammad

Overview

AI description

Automated description summarized from trusted sources.

CVE-2026-102489 is a session hijacking and remote code execution vulnerability affecting Zammad, an open-source helpdesk and customer support ticketing system. The flaw allows unauthenticated attackers to leak user sessions and remotely execute malicious code as the local `zammad` user. It affects Zammad versions 6.3.0 through 6.5.4 in an exploitable state. While the vulnerability is present in versions 7.0.0 through 7.1.3, environmental conditions prevent its exploitation in those later releases. The vulnerability gained public attention after being exploited as a zero-day alongside CVE-2026-102490, a local privilege escalation flaw, in an automated, agentic AI-powered attack against the Dutch Institute for Vulnerability Disclosure (DIVD) in September 2026. By chaining these two vulnerabilities, the automated agent was able to hijack sessions, execute code, and escalate privileges to root within seconds. To mitigate the issue, users are advised to upgrade to Zammad version 7 or take vulnerable instances offline.

Description: Zammad versions 6.3.0 to 6.5.4 are vulnerable a session hijack vulnerability that leads to remote code execution as the zammad user. The bug is also present in version 7.0.0 to version 7.1.2, but not exploitable due to changes in the underlying framework.
Source: csirt@divd.nl
NVD status: Analyzed
CNA Tags: unsupported-when-assigned
Products: zammad

Risk scores

CVSS 4.0

Type: Secondary
Base score: 9.4
Impact score: -
Exploitability score: -
Vector string: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:A/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:X/V:C/RE:X/U:X
Severity: CRITICAL

CVSS 3.1

Type: Primary
Base score: 9.8
Impact score: 5.9
Exploitability score: 3.9
Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Severity: CRITICAL

Known exploits

Data from CISA

Vulnerability name: Zammad GmbH Zammad Session Fixation Vulnerability
Exploit added on: Oct 2, 2026
Exploit action due: Oct 5, 2026
Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

Weaknesses

nvd@nist.gov: CWE-384
134c704f-9b21-4f2e-91b3-4a467353bcc0: CWE-384

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:zammad:zammad:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "20D0A6CD-50AC-46AD-91BE-6B4DC96B405A",
            "versionEndIncluding": "6.5.4",
            "versionStartIncluding": "6.3.0",
            "vulnerable": true
          }
        ],
        "negate": false,
        "operator": "OR"
      },
      {
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:docker:docker:-:*:*:*:*:*:*:*",
            "matchCriteriaId": "231A8A55-A319-4878-91DA-4FD91CF0549E",
            "vulnerable": false
          },
          {
            "criteria": "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*",
            "matchCriteriaId": "703AF700-7A70-47E2-BC3A-7FD03B3CA9C1",
            "vulnerable": false
          }
        ],
        "negate": false,
        "operator": "OR"
      }
    ],
    "operator": "AND"
  }
]

References

Sources include official advisories and independent security research.