CVE-2026-102489
Undisclosed RCE in Zammad v6.3 and higher
KEVCRITICAL 9.4EPSS 1.3%
Zammad versions 6.3.0 to 6.5.4 are vulnerable a session hijack vulnerability that leads to remote code execution as the zammad user. The vulnerability is also present in version 7.0.0 to version 7.1.3, but not exploitable due to environment conditions.
- Affected
- Zammad GmbH · Zammad
- CVSS v4.0 DIVD
- 9.4 CRITICAL
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:A/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:X/V:C/RE:X/U:X - CVSS v3.1 NVD
- 9.8 CRITICAL
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - EPSS
- 1.26% chance of exploitation in the next 30 days, 69th percentile
- CISA KEV
- added 2026-10-02
- Published
- 2026-09-30
- Updated
- 2026-10-10
Proof-of-concept exploits (4)
- Rubby2001/CVE-POCS5★ · 2026-10-10
- horizon3ai/CVE-2026-1024896★ · 2026-10-07
- Hunt-Benito/the-cookie-in-the-error-message-cve-2026-102489-zammad-session-hijack-to-rce0★ · 2026-10-07
- 1xPwn/CVE-2026-1024897★ · 2026-10-12
Security advisories
- https://community.zammad.org/t/take-care-local-privilege-escalation-cve-2026-102490-is-re…
- https://zammad.com/en/advisories/cve-2026-102489-cve-2026-102490
- https://csirt.divd.nl/CVE-2026-102489
- https://csirt.divd.nl/DIVD-2026-00015