CVE-2026-102489

UNKNOWN 0.0

Undisclosed RCE in Zammad v6.3 and higher

CVSS Score

0.0

EPSS Score

0.0%

EPSS Percentile

0th

Zammad versions 6.3.0 to 6.5.4 are vulnerable a session hijack vulnerability that leads to remote code execution as the zammad user. The vulnerability is also present in version 7.0.0 to version 7.1.3, but not exploitable due to environment conditions.

Vendor	zammad gmbh
Product	zammad
Published	Sep 30, 2026

Stay Ahead of the Next One

Get instant alerts for zammad gmbh zammad

Be the first to know when new unknown vulnerabilities affecting zammad gmbh zammad are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

Zammad GmbH / Zammad

6.3.0 < 6.5.4

References

NVD ↗ CVE.org ↗ EPSS Data ↗

csirt.divd.nl: https://csirt.divd.nl/DIVD-2026-00015 csirt.divd.nl: https://csirt.divd.nl/CVE-2026-102489

Credits

Earth Grob (Merlon Security) Luke paris (Merlon Security) Tijmen van der Spijk (Merlon Security) Zohar Cochavi (Merlon Security) Alje Woltjer (Merlon Security) Mischa Rick van Geelen (DIVD) Ralph Horn (DIVD) Max van der Horst (DIVD) Victor Pasman (DIVD) Frank Breedijk (DIVD)