🔴

CISA Known Exploited Vulnerability

This CVE is actively exploited in the wild. CISA mandates federal agencies to patch immediately.

CVE

CVE-2026-102489

8.7

CVSShigh

Exploitable remotely over the internet · no authentication required.

Description

Zammad versions 6.3.0 to 6.5.4 are vulnerable a session hijack vulnerability that leads to remote code execution as the zammad user. The bug is also present in version 7.0.0 to version 7.1.2, but not exploitable due to changes in the underlying framework.

Attack Vector

Network

Privileges Req.

None

User Interaction

zammad

Updated Nov 10, 2026View on NVD →

S4E scanner

criticalNetwork Vulnerabilities~10 seconds

Zammad 6.3.0-6.5.4 - Session Hijacking & Remote Code Execution

Zammad 6.3.0 to 6.5.4 contains a session hijack vulnerability caused by improper session management, letting remote attackers execute code as the zammad user, exploit requires vulnerable version and session hijack. References: https://zammad.com/en/advisories/cve-2026-102489-cve-2026-102490 https://csirt.divd.nl/CVE-2026-102489 https://horizon3.ai/attack-research/disclosures/cve-2026-102489-zammad-session-leak-rce/ https://github.com/horizon3ai/CVE-2026-102489 https://nvd.nist.gov/vuln/detail/CVE-2026-102489 Remediation: Update to a version later than 6.5.4 or 7.1.3 where the vulnerability is not exploitable.

9 assets checked · domain, subdomain, ipv4

Scanner page →Run scanner

CVE history: zammad

Predict next CVE date with AI

Monitor this CVE on your assets

S4E maps published CVEs to scanners and forecasts the next disclosure window for your stack.

Create a free account →