CVE-2026-102489

Zammad versions 6.3.0 to 6.5.4 are vulnerable a session hijack vulnerability that leads to remote code execution as the zammad user. The bug is also present in version 7.0.0 to version 7.1.2, but not exploitable due to changes in the underlying framework.

CVSS 4.0

9.4CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:A/AU:Y/V:C

CVSS 3.1

9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

2.0% chance of exploitation in the next 30 days; higher than 80% of CVEs (scores of 2026-10-25)

CISA KEV

listed 2026-10-02, due 2026-10-05

CWE

CWE-384

Published

2026-09-30

Modified

2026-10-10

Record from

the NVD, synced 2026-10-19

Affected

• zammad:zammad

References

• https://community.zammad.org/t/take-care-local-privilege-escalation-cve-2026-102490-is-reported-as-being-actively-exploited/21297/2
• https://csirt.divd.nl/CVE-2026-102489
• https://csirt.divd.nl/DIVD-2026-00015
• https://zammad.com/en/advisories/cve-2026-102489-cve-2026-102490
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-102489

Check your stackJSON