critical·Network Vulnerabilities·Updated Oct 28, 2026

Zammad 6.3.0-6.5.4 - Session Hijacking & Remote Code Execution

Est. Time~10 seconds

Scan TypeGroup Scan

Targetsdomain, subdomain, ipv4

CostFree

Times Used

continuous scan runs

Continuously Checked

assets under CS

Vulnerabilities Found

confirmed findings

References

github.com↗

🔴

CISA Known Exploited Vulnerability

This CVE is actively exploited in the wild. CISA mandates federal agencies to patch immediately.

CVECVE-2026-102489

8.7

CVSShigh

Exploitable remotely over the internet · no authentication required.

Description

Zammad versions 6.3.0 to 6.5.4 are vulnerable a session hijack vulnerability that leads to remote code execution as the zammad user. The bug is also present in version 7.0.0 to version 7.1.2, but not exploitable due to changes in the underlying framework.

Attack Vector

Network

Privileges Req.

None

User Interaction

Affected

Zammadby Zammad GmbH

AFFECTED< 6.3.0→SAFE ✓≥ 6.3.0

Updated Nov 10, 2026View on NVD →

Similar Tools

Check your infrastructure.
Right now.

12,000+ scanners. Free to start. No credit card required.

Zammad 6.3.0-6.5.4 - Session Hijacking & Remote Code Execution

Check your infrastructure.Right now.

Check your infrastructure.
Right now.