{"id":"CVE-2026-102489","kind":"vulnerability","aliases":["CVE-2026-102489"],"related":[],"title":"Zammad versions 6.3.0 to 6.5.4 are vulnerable a session hijack vulnerability that leads to remote code execution as…","description":"Zammad GmbH Zammad contains a session fixation vulnerability that can lead to remote code execution as the zammad user. This vulnerability can be chained with CVE-2026-102490.\n\nCISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","summary":"Zammad 6.3.0 to 6.5.4 (end-of-support) has a session fixation/hijack flaw giving RCE as the zammad user; CVSS vectors say no privileges needed. Exploited in the wild (CISA KEV, DIVD breach by chained CVE-2026-102490 root escalation). Zammad 7.0+ is not exploitable in practice. SaaS needs no action.","severity":"critical","cvss":9.8,"epss":null,"exploited":true,"exploited_at":"2026-10-02T00:00:00+00:00","products":[{"name":"Zammad GmbH Zammad","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"Zammad","fixed":["6.5.5","7.2.0"],"affected":">= 6.3.0, <= 6.5.4","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["exploited","helpdesk","kev","package","rce","self-hosted","session-fixation","zammad"],"not_affected_if":["managed-hosting","version-7.0-or-later","zammad-saas"],"how_to_check":"Check version: self-hosted Zammad 6.3.0 to 6.5.4 is vulnerable (Admin > System > Version, or 'zammad run rails r \"puts Zammad::Version.get\"'). Versions before 6.3.0 are unknown per DIVD. Run DIVD's log-check script from the DIVD-2026-00015 page for IoCs.","fix":"Upgrade to Zammad 7.2.2 (recommended; 7.2.0 includes the hardening change). If stuck on 6.5, update to 6.5.4 -> 6.5.5 emergency release, which requires switching to the new package repository first. Restrict server access; if compromised assume root (CVE-2026-102490) and rebuild.","status":"open","published_at":"2026-09-30T17:16:40+00:00","first_seen_at":"2026-10-23T19:11:50+00:00","triaged_at":"2026-10-23T19:50:04+00:00","updated_at":"2026-10-23T23:44:52+00:00","category":"package","confidence":0.85,"triage":{"at":"2026-10-23T19:50:04Z","model":"claude-haiku-5-5","output":{"fix":"Apply the vendor mitigations or update per Zammad GmbH's advisory; the affected and fixed versions are not stated in the sources. Follow CISA BOD 26-04 guidance and discontinue use if mitigations are unavailable.","summary":"Zammad, a self-hosted helpdesk and ticketing system, has a session fixation flaw that can lead to remote code execution as the zammad user. CISA lists it as actively exploited, and it can be chained with CVE-2026-102490.","category":"package","who_cares":["zammad","self-hosted","helpdesk"],"confidence":0.5,"analyst_note":"Find affected and fixed Zammad versions and the vendor advisory from Zammad GmbH and the CISA KEV entry for CVE-2026-102489; confirm whether the zammad-user RCE is reachable without auth.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["managed-hosting"],"severity_if_unknown":"high"},"cost_usd":0.000392,"input_tokens":2211,"output_tokens":342,"severity_before":"unknown"},"analyst_status":"done","analyst_note":"Find affected and fixed Zammad versions and the vendor advisory from Zammad GmbH and the CISA KEV entry for CVE-2026-102489; confirm whether the zammad-user RCE is reachable without auth.","search":"'-04':136C,162C,193C '-102489':20A,23A '-102490':77B,118C '-2026':19A,22A,76B,117C '26':135C,161C,192C '6.3.0':3A,41B '6.5.4':5A,43B '7.0':81B 'accord':125C 'action':90B,121C 'adher':189C 'appli':122C 'applic':159C 'asset':183C 'base':140C 'bod':134C,160C,191C 'breach':72B 'chain':74B,114C 'cisa':69B,119C,132C,149C 'cloud':165C 'code':16A,104C 'complianc':130C 'contain':94C 'cve':18A,21A,75B,116C 'cvss':59B 'discontinu':168C 'divd':71B 'end':45B 'end-of-support':44B 'ensur':129C,188C 'escal':79B 'evalu':181C 'execut':17A,105C 'exploit':28B,65B,84B 'exposur':186C 'fixat':38B,97C 'fixation/hijack':51B 'flaw':52B 'follow':158C 'forens':151C 'give':53B 'gmbh':25A,92C 'guidanc':147C,163C 'guidelin':195C 'helpdesk':29B 'hijack':10A 'host':35B 'instruct':128C 'internet':185C 'kev':30B,70B 'lead':13A,101C 'mitig':123C,174C 'need':64B,88B 'note':146C,157C 'packag':31B 'patch':194C 'practic':86B 'priorit':137C 'privileg':63B 'product':172C 'rce':32B,54B 'remot':15A,103C 'requir':120C,153C 'respons':179C 'risk':142C 'root':78B 'saa':87B 'say':61B 'secur':138C 'see':143C,154C 'self':34B 'self-host':33B 'servic':166C 'session':9A,37B,50B,96C 'session-fix':36B 'stakehold':177C 'support':47B 'triag':152C 'unavail':176C 'updat':139C 'url':144C,155C 'use':169C 'user':58B,109C 'vector':60B 'vendor':127C 'version':2A 'vulner':7A,11A,98C,111C 'wild':68B 'zammad':1A,24A,26A,27A,39B,40B,57B,80B,91C,93C,108C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-09-30T17:16:40+00:00","kev":{"dateAdded":"2026-10-02","dueDate":"2026-10-05","requiredAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:A/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:X/V:C/RE:X/U:X","cvss_by":"csirt@divd.nl","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2026-102489","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-102489","severity":null,"published_at":"2026-10-02T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:50+00:00","fetched_at":"2026-10-25T10:39:04+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-102489:14","url":null,"severity":null,"published_at":"2026-10-23T20:27:51+00:00","modified_at":"2026-10-23T20:27:51+00:00","first_seen_at":"2026-10-23T20:27:51+00:00","fetched_at":"2026-10-23T20:27:51+00:00","note":"Vendor advisory (zammad.com, 2026-10-05) and DIVD-2026-00015: Zammad 6.3.0-6.5.4 exploitable (WebSocket session hijack to RCE as zammad user); 7.0+ not exploitable in practice; fix is 6.5.5 emergency release (new repo) or 7.2.x. Severity raised: CISA KEV, exploited in the wild, CVSS 9.8 (NVD) / 9.4 v4 with PR:N. Unauthenticated per CVSS vectors; vendor advisory does not spell out the mechanism. Chained with CVE-2026-102490 (local priv-esc to root, DEB/RPM packages only)."},{"source":"nvd","external_id":"CVE-2026-102489","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102489","severity":null,"published_at":"2026-09-30T17:16:40+00:00","modified_at":"2026-10-10T04:18:08+00:00","first_seen_at":"2026-10-23T23:44:52+00:00","fetched_at":"2026-10-23T23:44:52+00:00","note":null}],"documents":[{"id":833,"url":"https://zammad.com/en/advisories/cve-2026-102489-cve-2026-102490","title":"Zammad advisory CVE-2026-102489 & CVE-2026-102490","kind":"vendor","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":834,"url":"https://zammad.com/en/product/releases/6-5-5","title":"Zammad 6.5.5 Critical Security Update","kind":"release","source":"analyst","text":null,"published_at":null,"relation":"fix","confidence":null,"note":null},{"id":835,"url":"https://csirt.divd.nl/cases/DIVD-2026-00015/","title":"DIVD-2026-00015 case page","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":836,"url":"https://www.cisa.gov/news-events/alerts/2026/10/02/cisa-adds-two-known-exploited-vulnerabilities-catalog","title":"CISA KEV additions 2026-10-02","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null},{"id":837,"url":"https://www.sysdig.com/blog/ai-agent-exploits-zammad-zero-days-in-divd-breach-what-we-know-and-how-to-detect-it","title":"Sysdig: AI agent exploits Zammad zero-days in DIVD breach","kind":"blog","source":"analyst","text":null,"published_at":null,"relation":"discussion","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}