Session Hijacking Vulnerability in Zammad by Zammad GmbH
CVE-2026-102489
Key Information:
- Vendor
Zammad Gmbh
- Status
- Vendor
- CVE Published:
- 30 September 2026
Badges
What is CVE-2026-102489?
CVE-2026-102489 is a session hijacking vulnerability identified in Zammad, a popular open-source helpdesk and customer support software developed by Zammad GmbH. This vulnerability affects versions 6.3.0 through 6.5.4 and also versions 7.0.0 to 7.1.3, but with limited exploitability in the latter due to specific environmental conditions. The core of this vulnerability allows an attacker to hijack a user session, leading to unauthorized access with the privileges of the zammad user. Such unauthorized access could facilitate further exploitation, including remote code execution, which poses a significant threat to organization security. Organizations leveraging Zammad for customer support operations must be aware of this vulnerability, as it can severely undermine the integrity of sensitive customer interactions and data.
Potential impact of CVE-2026-102489
-
Unauthorized Access to Sensitive Data: The ability to hijack user sessions can grant attackers access to confidential customer information and operational data within Zammad, increasing the risk of data breaches and privacy violations.
-
Remote Code Execution: Should an attacker successfully exploit this vulnerability, they can execute arbitrary code as the zammad user, which could facilitate further attacks, including the deployment of malware or ransomware within the organization's environment.
-
Service Disruption: Exploiting this vulnerability could compromise the functionality of the affected systems, potentially leading to service outages or degraded performance, which can disrupt customer support operations and impact business reputation.
CISA has reported CVE-2026-102489
CISA provides regional cyber and physical services to support security and resilience across the United States. CISA monitor the most dangerious vulnerabilities and have identifed CVE-2026-102489 as being exploited but is not known by the CISA to be used in ransomware campaigns. This is subject to change at pace
The CISA's recommendation is: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Affected Version(s)
Zammad Linux 6.3.0 < 6.5.4
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.
News Articles
CybersecuritynewsCVE-2026-102489PoC Released for Zammad Session Leak Flaw Enabling Remote Code Execution
Public PoC released for CVE-2026-102489, a critical Zammad flaw enabling unauthenticated session cookie theft and potential code execution.
1 month ago
It Security NewsCVE-2026-102489PoC Exploit Released for Zammad Vulnerability Enabling Session Hijacking and Remote Code Execution - IT Security News
2026-10-08 15:10 A proof-of-concept (PoC) exploit has been released for CVE-2026-102489, a critical vulnerability in Zammad that can expose active users’ session cookies and enable remote...
1 month ago
CISA Warns of Zammad DIVD Vulnerabilities Actively Exploited in Attacks
CISA added two Zammad flaws to its KEV catalog after active exploitation reports, the flaws can be chained for high-level server control.
1 month ago
References
EPSS Score
22% chance of being exploited in the next 30 days.
CVSS V4
Timeline
- 🦅
CISA Reported
- 👾
Exploit known to exist
- 📰
First article discovered by Techtimes
- 🟡
Public PoC available
Vulnerability published
Vulnerability Reserved