Zero Radar
← feed
CriticalVulnerabilityCVE-2026-102489updated 25 Oct 2026, 17:35 UTC

Zammad: session hijack can lead to remote code execution

Attackers can take over a logged-in user's session in Zammad, the help desk software, and from there run their own commands on the server. Anyone who can reach an unpatched Zammad over the internet is at risk.

Exploited (CISA KEV)Official, 2 sources
SeverityCriticalCVSS 9.4 of 10
Being exploited?YesConfirmed by CISA KEV · 2 Oct 2026,
Fix available?UnclearNo fixed version published in the sources yet
How sure is this?Official, 2 sourcesBacked by an official source

How the attack works simplified

  1. 1AttackerTargets a Zammad user's session
  2. 2Session fixationAttacker forces or steals a session
  3. 3Session hijackAttacker acts as the logged-in user
  4. 4Remote code executionCommands run as the zammad user
  5. ResultAttacker controls the Zammad server

What happened

Zammad versions 6.3.0 to 6.5.4 contain a session fixation flaw that allows session hijacking, which leads to remote code execution as the zammad user. A related flaw, CVE-2026-102490, can be chained with it.

Why it is dangerous: A successful attacker can run arbitrary code on the Zammad server as the zammad service user, exposing customer tickets and data stored there. CISA confirms active exploitation, so internet-facing instances are the highest priority.

Are you affected?

You are affected if you run Zammad versions 6.3.0 through 6.5.4, or Zammad 7.0.0 through 7.1.3 (the advisory says the flaw is present there but not exploitable due to environment conditions).

Zammad 6.3.0 to 6.5.4; Zammad 7.0.0 to 7.1.3 (present but not exploitable under certain environment conditions)

What to do

  1. Check your Zammad version and identify whether it falls in the affected ranges.
  2. Apply the fixed release or the vendor's mitigation as published by Zammad GmbH.
  3. If no mitigation is available, restrict internet access to the Zammad instance or discontinue use, as CISA directs.
  4. Review logs for signs of session hijacking or unexpected server activity, following CISA's forensics triage guidance.

Timeline

  1. 30 Sept 2026, 18:33 UTC
    Publicly disclosed
  2. 2 Oct 2026, 00:00 UTC
    Reported by CISA KEV · CISA KEV
  3. 25 Oct 2026, 17:35 UTC
    GitHub Advisory reported on it · GitHub Advisory

Sources 2 reports, oldest first

Official vendor, government CERT or advisory database

Technical details

ID
CVE-2026-102489 · GHSA-xmw5-m2wg-4243
CVSS
9.4 / 10
EPSS
22% chance of exploitation within 30 days
Disclosed
30 Sept 2026, 18:33 UTC
On Zero Radar
before the radar started
Last change
25 Oct 2026, 17:35 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

Zammad: session hijack can lead to remote code execution · Zero Radar