Zammad versions 6.3.0 to 6.5.4 are vulnerable a session hijack vulnerability that leads to remote code execution as the zammad user. The vulnerability is also present in version 7.0.0 to version 7.1.…
Critical CVSS 9.8 Listed in CISA KEV
Summary
Zammad versions 6.3.0 to 6.5.4 are vulnerable a session hijack vulnerability that leads to remote code execution as the zammad user. The vulnerability is also present in version 7.0.0 to version 7.1.3, but not exploitable due to environment conditions.
In-depth triage
No in-depth report has been generated yet (DR-003 v2 AI pipeline is under construction).
Affected products
- :
- Zammad GmbH:Zammad
- :
Sources
- NVD DATABASE
- CISA KEV DATABASE
- Grok bot vulnerability crawler DATABASE
Original Links
- https://csirt.divd.nl/CVE-2026-102489 Third Party Advisory
- https://csirt.divd.nl/DIVD-2026-00015 Third Party Advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-102489 US Government Resource
- https://zammad.com/en/product/releases/ reference
- https://community.zammad.org/t/take-care-local-privilege-escalation-cve-2026-102490-is-reported-as-being-actively-exploited/21297/2 reference
- https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk reference
- https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk reference
- https://nvd.nist.gov/vuln/detail/CVE-2026-102489 reference
- https://zammad.com/en/advisories/cve-2026-102489-cve-2026-102490 Vendor Advisory
Timeline
- nvd_ingest NVD
- kev_ingest CISA KEV
- grok_bot_ingest Grok bot vulnerability crawler