IT SBIT Services
Schneeberger
DEEN
CVE tracker

Zammad: Session hijacking leading to remote code execution

CVE-2026-102489Critical 9.4Actively exploitedPublic exploit

← All vulnerabilities

Actively exploited – in the CISA catalogue of Known Exploited Vulnerabilities since 2 Oct 2026
Deadline for US federal agencies: 5 Oct 2026

Summary

Zammad, an open-source helpdesk platform, contains a session hijacking flaw (CWE-384) that can lead to remote code execution as the zammad user. CISA lists the vulnerability as known exploited, added to the KEV catalog on 2 October 2026. According to the vendor, exploitation is only possible on Zammad 6.5 and earlier, which are out of support, while the status of versions 7.0.0 to 7.1.x is disputed. The CVSS vector requires no login and passive user interaction.

Affected

  • Zammad 6.3.0 to below 6.5.4 (DIVD CVE record)
  • Zammad 6.5 and earlier: exploitable according to the vendor; out of support
  • Zammad 7.0.0 to 7.1.x: disputed; the vendor says not affected in practice, DIVD says present but not exploitable under the runtime conditions
  • Versions below 6.3.0: unknown

Fixed in

  • Zammad 7.2.0 (vendor; includes additional hardening of the affected code)
  • Some secondary sources mention 7.2.2; not confirmed by Zammad
  • Zammad 6.5 and earlier: no security fixes, upgrade required

Workaround

  • Restrict access to the underlying Zammad server to trusted administrators only.
  • Upgrading is the only real fix; no other vendor-confirmed workaround is known.

Exploitation

  • CISA KEV: known exploited, added on 2 October 2026.
  • DIVD reports it was breached on 21 September 2026 through two unknown Zammad vulnerabilities, attributed to an AI-agent-driven attack.
  • A public proof-of-concept exploit is reported by third parties; not verified here.
  • Zammad says exploitation is only possible on 6.5 and earlier.

Our recommendation

  • Update Zammad to 7.2.0 or later immediately.
  • Upgrade any instance running Zammad 6.5 or older; these versions no longer receive security fixes.
  • Restrict access to the Zammad server to trusted administrators.
  • Check logs for indicators of compromise, especially on internet-facing 6.x instances.
  • Monitor the Zammad security advisories for CVE-2026-102490 (local privilege escalation).

Public exploits

Links to third-party sites, not checked by us – exploit code can contain malware. Only use it in isolated test environments.

Research sources

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 13:26.

Original description (NVD)

Zammad versions 6.3.0 to 6.5.4 are vulnerable a session hijack vulnerability that leads to remote code execution as the zammad user. The bug is also present in version 7.0.0 to version 7.1.2, but not exploitable due to changes in the underlying framework.

Required action (CISA)

Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

NVD references (5)

Sources

The tracker combines official, freely usable data sources – updated continuously:

This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.

Affected? We can help.

We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.

Get in touchRSS feed