CVE-2026-102489
Undisclosed RCE in Zammad v6.3 and higher
CVSS Score
0.0
EPSS Score
1.3%
EPSS Percentile
69th
Zammad versions 6.3.0 to 6.5.4 are vulnerable a session hijack vulnerability that leads to remote code execution as the zammad user. The bug is also present in version 7.0.0 to version 7.1.2, but not exploitable due to changes in the underlying framework.
| Vendor | zammad gmbh |
| Product | zammad |
| Published | Sep 30, 2026 |
| Last Updated | Oct 10, 2026 |
⚠️ Actively Exploited — Act Now
Get instant alerts for zammad gmbh zammad
This vulnerability is actively exploited in the wild. Set up free real-time alerts so you're first to know about threats like CVE-2026-102489.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Zammad GmbH / Zammad
6.3.0 < 6.5.4
References
csirt.divd.nl: https://csirt.divd.nl/DIVD-2026-00015 csirt.divd.nl: https://csirt.divd.nl/CVE-2026-102489 zammad.com: https://zammad.com/en/advisories/cve-2026-102489-cve-2026-102490 community.zammad.org: https://community.zammad.org/t/take-care-local-privilege-escalation-cve-2026-102490-is-reported-as-being-actively-exploited/21297/2 cisa.gov: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-102489
Credits
Earth Grob (Merlon Security) Luke Paris (Merlon Security) Tijmen van der Spijk (Merlon Security) Zohar Cochavi (Merlon Security) Alje Woltjer (Merlon Security) Mischa Rick van Geelen (DIVD) Ralph Horn (DIVD) Max van der Horst (DIVD) Victor Pasman (DIVD) Frank Breedijk (DIVD) Zammad