Vulnerability details

CVE-2026-102489

Actively exploited

Zammad Zammad

Undisclosed RCE in Zammad v6.3 and higher

CVSS 4.0

8.7High

Official description

Zammad versions 6.3.0 to 6.5.4 are vulnerable a session hijack vulnerability that leads to remote code execution as the zammad user. The bug is also present in version 7.0.0 to version 7.1.2, but not exploitable due to changes in the underlying framework.

CVSS scores

Score	Version	Source	Vector
8.7High	4.0	CVEProject cvelistV5 (CNA) (DIVD)	`CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:A/AU:Y/V:C`

Affected products

Vendor	Product	Versions	Source
Zammad GmbH	Zammad	v < 6.3.0	CVEProject cvelistV5 (CNA)
Zammad GmbH	Zammad	6.3.0 ≤ v < 6.5.4	CVEProject cvelistV5 (CNA)
Zammad GmbH	Zammad	7.0.0 ≤ v < 7.1.3	CVEProject cvelistV5 (CNA)

References and advisories

https://csirt.divd.nl/DIVD-2026-00015 third-party-advisory
https://csirt.divd.nl/CVE-2026-102489 third-party-advisory
https://zammad.com/en/advisories/cve-2026-102489-cve-2026-102490 vendor-advisory
https://community.zammad.org/t/take-care-local-privilege-escalation-cve-2026-102490-is-reported-as-being-actively-exploited/21297/2 technical-description
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-102489 government-resource

Kolun on Telegram @kolunsec Exploited CVEs, key news and a daily digest Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.

Details

Published: 2026-09-30
Last updated: 2026-10-19
State: Published
Assigner (CNA): DIVD
Kolun priority: 78 · High

CISA KEV catalog

Date added: 2026-10-02
Due date: 2026-10-05
Used in ransomware: Unknown

Exploit prediction (EPSS)

49.91%

Probability of exploitation in 30 days

98.9%

Percentile (among all CVEs)

2026-11-0749.91%
2026-11-0322.47%

SSVC assessment (CISA)

Automatable: No
Exploitation: Active
Technical impact: Total

Weaknesses (CWE)

CWE-384
Session Fixation