CVE-2026-102489: zammad zammad

CVSS 9.8 (critical) · listed as exploited by CISA since 2026-10-02 · published 2026-09-30

Zammad versions 6.3.0 to 6.5.4 are vulnerable a session hijack vulnerability that leads to remote code execution as the zammad user. The bug is also present in version 7.0.0 to version 7.1.2, but not exploitable due to changes in the underlying framework.

Affected products (NVD): zammad zammad

Weakness: CWE-384

Source: NVD CVE-2026-102489

References

• https://community.zammad.org/t/take-care-local-privilege-escalation-cve-2026-102490-is-reported-as-being-actively-exploited/21297/2
• https://csirt.divd.nl/CVE-2026-102489
• https://csirt.divd.nl/DIVD-2026-00015
• https://zammad.com/en/advisories/cve-2026-102489-cve-2026-102490
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-102489

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.