CVE-2026-102489

Published: Sep 30, 2026Modified: Oct 10, 2026CISA KEV

9.4

Vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:A/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:X/V:C/RE:X/U:X

Show more

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:A/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:X/V:C/RE:X/U:XShow less

Source: csirt@divd.nl (Secondary)

Description

Zammad versions 6.3.0 to 6.5.4 are vulnerable a session hijack vulnerability that leads to remote code execution as the zammad user. The bug is also present in version 7.0.0 to version 7.1.2, but not exploitable due to changes in the underlying framework.

Affected (1)

Products: Zammad: Zammad

1 product

Configuration A

1 vulnerable · 2 platform

Vulnerable Software	Affected Versions
Zammad Zammad	6.3.0 ≤ version ≤ 6.5.4

Running on/with	Platform Versions
Docker Docker	All versions
Linux Linux Kernel	All versions

Related CWEs

Session Fixation

Authenticating a user, or otherwise establishing a new user session, without invalidating any existing session identifier gives an attacker the opportunity to steal authenticated sessions.

References (5)

https://community.zammad.org/t/take-care-local-privilege-escalation-cve-2026-102490-is-reported-as-being-actively-exploited/21297/2

Source: csirt@divd.nl

Vendor Advisory

https://csirt.divd.nl/CVE-2026-102489

Source: csirt@divd.nl

Third Party Advisory

https://csirt.divd.nl/DIVD-2026-00015

Source: csirt@divd.nl

Third Party Advisory

https://zammad.com/en/advisories/cve-2026-102489-cve-2026-102490

Source: csirt@divd.nl

Vendor Advisory

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-102489

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

US Government Resource

Timeline

No history available yet.