CVE-2026-102489
Undisclosed RCE in Zammad v6.3 and higher
- State
- Published
- Severity
- 8.7 High
- Published
- Sep 30, 2026
- Updated
- Oct 19, 2026
- Reserved
- Sep 29, 2026
Description
Zammad versions 6.3.0 to 6.5.4 are vulnerable a session hijack vulnerability that leads to remote code execution as the zammad user. The bug is also present in version 7.0.0 to version 7.1.2, but not exploitable due to changes in the underlying framework.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 8.7 High | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:A/AU:Y/V:C | DIVD |
| 4.0 | 9.4 Critical | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:A/AU:Y/V:C | DIVD |
Weaknesses
- CWE-384 Session Fixation
Affected Products
| Product | Versions |
|---|---|
ZammadZammad GmbH |
|
References
- https://csirt.divd.nl/DIVD-2026-00015third-party-advisory
- https://csirt.divd.nl/CVE-2026-102489third-party-advisory
- https://zammad.com/en/advisories/cve-2026-102489-cve-2026-102490vendor-advisory
- https://community.zammad.org/t/take-care-local-privilege-escalation-cve-2026-102490-is-reported-as-being-actively-exploited/21297/2technical-description
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-102489government-resource
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.