CVE-2026-102489: Zammad Session Fixation Leading to RCE as the zammad User

CVE-2026-102489 is a session-fixation vulnerability (CWE-384) in Zammad, the open-source helpdesk/ticketing system, that lets an attacker hijack a victim's session and run code as the zammad service user on versions 6.3.0 through 6.5.4, and it was added to the CISA Known Exploited Vulnerabilities catalog on 2026-10-02 alongside a related local privilege-escalation CVE in the same Zammad release line.

CVE-2026-102489 affects Zammad, an open-source customer-support and ticketing platform used by IT and support teams. NVD's description states: "Zammad versions 6.3.0 to 6.5.4 are vulnerable a session hijack vulnerability that leads to remote code execution as the zammad user. The bug is also present in version 7.0.0 to version 7.1.2, but not exploitable due to changes in the underlying framework" (NVD).

NVD's own analysis assigns CWE-384 (Session Fixation) and a CVSS v3.1 base score of 9.8 (critical), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H — network-reachable, low attack complexity, no privileges or user interaction required, with high impact to confidentiality, integrity and availability (NVD).

CISA added CVE-2026-102489 to the Known Exploited Vulnerabilities catalog on 2026-10-02, with a required-action due date of 2026-10-05, the same day it added a related local privilege-escalation flaw (CVE-2026-102490) affecting the DEB/RPM packaged builds of the same Zammad release line; the catalog records known ransomware campaign use as "Unknown" for this CVE (CISA KEV).

Zammad's own security advisory page and a public statement from the Zammad team describe CVE-2026-102489 as affecting "Zammad 6.5 and earlier" (end-of-support versions), state that current 7.0+ releases are unaffected in practice because of changes made to the underlying framework, and confirm that hardening against this issue is included in the current stable release, version 7.2.0. Zammad recommends administrators upgrade immediately if still running 6.5 or older, since those versions no longer receive security patches (Zammad Security Advisory).

As of 2026-10-27, FIRST scores the probability of exploitation at 0.01955 (80.161th percentile) (FIRST EPSS).

Because Zammad 6.5 and earlier are end-of-support and this CVE is confirmed in CISA's KEV catalog, any instance still running an affected version should be upgraded to 7.2.0 or later immediately and checked for signs of prior session hijacking or unexpected zammad-user activity.

• Zammad 6.3.0-6.5.4 are vulnerable to a session-hijack flaw leading to RCE as the zammad user (CWE-384); bug also present but not exploitable in 7.0.0-7.1.2 due to framework changes. — NVD
• NVD CVSS v3.1 base score is 9.8 (critical), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. — NVD
• Added to the CISA KEV catalog on 2026-10-02, due date 2026-10-05, the same day as a related local privilege-escalation CVE (CVE-2026-102490) in the same Zammad release line; ransomware use listed as Unknown. — CISA KEV
• Affects Zammad 6.5 and earlier (end-of-support); 7.0+ unaffected in practice; hardening included in the current stable release 7.2.0; administrators urged to upgrade immediately if on 6.5 or older. — Zammad Security Advisory
• EPSS score is 0.01955 (80.161th percentile) as of 2026-10-27. — FIRST EPSS