Undisclosed RCE in Zammad v6.3 and higher
Summary
| CVE | CVE-2026-102489 |
|---|---|
| State | PUBLISHED |
| Assigner | DIVD |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2026-09-30 17:16:40 UTC |
| Updated | 2026-10-10 04:18:08 UTC |
| Description | Zammad versions 6.3.0 to 6.5.4 are vulnerable a session hijack vulnerability that leads to remote code execution as the zammad user. The bug is also present in version 7.0.0 to version 7.1.2, but not exploitable due to changes in the underlying framework. |
Risk And Classification
Primary CVSS: v4.0 9.4 CRITICAL from [email protected]
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:A/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:X/V:C/RE:X/U:X
EPSS: 0.012550000 probability, percentile 0.692430000 (date 2026-10-21)
CISA KEV: Listed on 2026-10-02; due 2026-10-05; ransomware use Unknown
Problem Types: CWE-384 | CWE-384 CWE-384 Session Fixation
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 4.0 | [email protected] | Secondary | 9.4 | CRITICAL | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:A/C... |
| 4.0 | CNA | CVSS | 8.7 | HIGH | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:A/A... |
| 4.0 | CNA | CVSS | 9.4 | CRITICAL | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:A/A... |
| 3.1 | [email protected] | Primary | 9.8 | CRITICAL | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
CVSS v4.0 Breakdown
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:A/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:X/V:C/RE:X/U:X
CVSS v3.1 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA Known Exploited Vulnerability
| Vendor | Zammad GmbH |
|---|---|
| Product | Zammad |
| Name | Zammad GmbH Zammad Session Fixation Vulnerability |
| Required Action | Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. |
| Notes | https://zammad.com/en/product/releases/ ; https://community.zammad.org/t/take-care-local-privilege-escalation-cve-2026-102490-is-reported-as-being-actively-exploited/21297/2 ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-102489 |
NVD Known Affected Configurations (CPE 2.3)
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|---|---|---|---|
| CNA | Zammad GmbH | Zammad | unknown * 6.3.0 semver | Linux, Docker |
| CNA | Zammad GmbH | Zammad | affected 6.3.0 6.5.4 semver | Linux, Docker |
| CNA | Zammad GmbH | Zammad | unknown 7.0.0 7.1.3 semver | Linux, Docker |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| csirt.divd.nl/DIVD-2026-00015 | [email protected] | csirt.divd.nl | Third Party Advisory |
| csirt.divd.nl/CVE-2026-102489 | [email protected] | csirt.divd.nl | Third Party Advisory |
| www.cisa.gov/known-exploited-vulnerabilities-catalog | 134c704f-9b21-4f2e-91b3-4a467353bcc0 | www.cisa.gov | US Government Resource |
| zammad.com/en/advisories/cve-2026-102489-cve-2026-102490 | [email protected] | zammad.com | Vendor Advisory |
| community.zammad.org/t/take-care-local-privilege-escalation-cve-2026-102490-is-rep... | [email protected] | community.zammad.org | Vendor Advisory |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
| CISA Known Exploited Vulnerabilities catalog | CISA | www.cisa.gov | kev |
Vendor Comments And Credit
Discovery Credit
CNA: Earth Grob (Merlon Security) (en)
CNA: Luke Paris (Merlon Security) (en)
CNA: Tijmen van der Spijk (Merlon Security) (en)
CNA: Zohar Cochavi (Merlon Security) (en)
CNA: Alje Woltjer (Merlon Security) (en)
CNA: Mischa Rick van Geelen (DIVD) (en)
CNA: Ralph Horn (DIVD) (en)
CNA: Max van der Horst (DIVD) (en)
CNA: Victor Pasman (DIVD) (en)
CNA: Frank Breedijk (DIVD) (en)
CNA: Zammad (en)