Zammad session hijack leads to remote code execution, actively exploited (CVE-2026-102489)

What happened

The CVE record describes a session hijack vulnerability (CWE-384) in Zammad that can lead to remote code execution as the zammad user. The CVSS 4.0 score is 9.4, critical, with a network attack vector, low attack complexity, no privileges required and passive user interaction. The vector records high impact for confidentiality, integrity and availability on the vulnerable system and on subsequent systems.

The vulnerability is also present in Zammad 7.0.0 to 7.1.3, but not exploitable there due to environment conditions.

CISA added this CVE to the Known Exploited Vulnerabilities catalog on 2 October 2026 and set a due date of 5 October 2026. CISA's SSVC assessment marks exploitation as active and automatable, with total technical impact. The record does not mark the vulnerability as publicly disclosed.

Who is affected

The affected range is Zammad 6.3.0 to before 6.5.4. The CVE record additionally states that the vulnerability is present in Zammad 7.0.0 to 7.1.3, but not exploitable there due to environment conditions. Organisations running Zammad should verify whether their version falls in the affected range 6.3.0 to before 6.5.4.

What to do now

1. Upgrade affected Zammad installations to Zammad 6.5.4, the fixed release listed in the CVE record.
2. Follow CISA's KEV required action: apply mitigations in accordance with vendor instructions and BOD 26-04 guidance, or discontinue use of the product if mitigations are unavailable.
3. Until the upgrade is complete, restrict network exposure to Zammad instances, particularly any internet-facing deployment, and review authentication and session activity for anomalies. No vendor workaround is listed in the CVE record.

How to detect it

No vendor or CISA detection guidance or indicators are published in the CVE record. If patching is delayed, focus on internet-exposed Zammad instances and review authentication and session activity for unexpected changes.

Beyond the patch

Because CISA KEV lists this vulnerability as actively exploited, detection and response are the first line while patching is underway; Managed Detection & Response (MDR) is designed for that. The CVSS vector shows a network-reachable service with no privileges required, so Virtual CISO Services (vCISO) can help you map your exposure and reduce your internet-facing attack surface.