cyfenced.com →

[ CVE-2026-102489 · Published 30 Sep 2026 ]

Session hijack leads to code execution in Zammad

Exploited · CISA KEV CVSS 9.8 EPSS 1%2 agency advisoriesNo fix listed yet

[ Why it matters ]Priority signals

  • Exploited in the wild: on CISA's Known Exploited Vulnerabilities list since 2026-10-02
  • Critical severity: CVSS 9.8
  • Urgent advisory from NCSC-NL

[ Analyst view ]Is this a red alert for you?

Red alert

CISA lists it as exploited and the attack needs no credentials.

Red alert if
You run a self-hosted Zammad 6.3.0 to 6.5.4 reachable from the internet.
Can wait if
You use the Zammad hosted service or run 7.x, which cannot be exploited; still upgrade to the current release.
What it is
A session fixation flaw in the Zammad helpdesk system lets an attacker hijack a session and run code as the zammad user. Versions 6.3.0 to 6.5.4 are exploitable; 7.0.0 to 7.1.2 contain the bug but cannot be exploited.
Impact
An attacker can take over sessions and run code on the helpdesk server without credentials. A helpdesk holds customer conversations, personal data and often integration credentials, and CISA also lists a related local privilege escalation (CVE-2026-102490) as exploited, which can take an attacker from the zammad user to full control of the server.

How an attack would work MITRE ATT&CK

  1. T1190 Exploit Public-Facing ApplicationThe attacker targets the Zammad web interface exposed to the internet.
  2. T1550.004 Use Alternate Authentication Material: Web Session CookieA fixed session lets them act as a logged-in user.
  3. T1059 Command and Scripting InterpreterThe hijacked session leads to commands running as the zammad user.
  4. T1068 Exploitation for Privilege EscalationCVE-2026-102490 can then be used to gain root on the server.

What to do

  1. Upgrade Zammad to 7.2.2 or later, which also fixes the exploited privilege escalation CVE-2026-102490 in the DEB and RPM packages.
  2. Review the Zammad server for unknown processes, files and administrator accounts.
  3. Sign out all users and rotate the integration credentials Zammad stores, such as email and API tokens.
  4. If you find signs of compromise, treat the customer data in the helpdesk as exposed and follow your breach process.
Written with AI from the sources on this page on 23 Oct 2026. Check the vendor's advisory before you act.

[ Description ]Official description

Zammad versions 6.3.0 to 6.5.4 are vulnerable a session hijack vulnerability that leads to remote code execution as the zammad user. The bug is also present in version 7.0.0 to version 7.1.2, but not exploitable due to changes in the underlying framework.

CISA: Zammad GmbH Zammad contains a session fixation vulnerability that can lead to remote code execution as the zammad user. This vulnerability can be chained with CVE-2026-102490.

[ Fixes ]Fixes and patches

CISA required action (US federal deadline 5 Oct 2026): Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.

[ Advisories ]Government CERT advisories

[ References ]References