CVE-2026-102489 - PatchNow

📋 Vulnerability Details

Data Source: CIRCL

Confidence: HIGH

Exploitation Method: DIRECT_NETWORK

CVE Published: 2026-09-30

Added to CISA KEV: 2026-10-02 2 DAYS BETWEEN CVE AND KEV

🎯 Recommendations:

CRITICAL: This CVE is listed in the CISA KEV Catalog with confirmed active exploitation. Treat as an emergency — assume compromise if running affected versions (6.3.0–6.5.4) and initiate incident response procedures immediately.
IMMEDIATE: Upgrade Zammad to version 7.0.0 or later (the CNA lists 7.0.0+ as unaffected). Verify the specific patched release version against official Zammad security advisories at https://zammad.com/en/advisories.
IMMEDIATE: Review Zammad application logs and web server access logs for anomalous session token usage, unexpected API calls, unusual system-level process execution originating from the 'zammad' OS user, and any signs of lateral movement.
IMMEDIATE: Check for indicators of compromise including unexpected cron jobs, new user accounts, modified files in the Zammad installation directory, and outbound network connections from the Zammad host.
SHORT-TERM: If patching cannot be performed immediately, restrict access to the Zammad instance via IP allowlisting at the firewall or reverse proxy level, limiting exposure to known trusted IP ranges.
SHORT-TERM: Monitor for signs of chained exploitation with CVE-2026-102490 — specifically privilege escalation attempts from the 'zammad' user to root. Audit sudo rules, SUID binaries, and kernel-level access from the zammad account.
SHORT-TERM: Rotate all Zammad API tokens, OAuth credentials, and database passwords as a precautionary measure if the instance was internet-exposed while running vulnerable versions.
ONGOING: Implement session token monitoring and anomaly detection for the Zammad application. Alert on session tokens used from multiple distinct IP addresses or geographic locations within short time windows.
ONGOING: Prioritise this patch at P1/Critical level. CISA KEV listings carry a mandatory remediation deadline for US federal agencies (typically 2 weeks); commercial organisations should treat this with equivalent urgency.
ONGOING: Review whether Zammad needs to remain fully public-facing or whether access can be restricted to authenticated VPN users for internal helpdesk use cases, reducing the attack surface.

🔍 Web Intelligence (Kagi · 2026-10-02)

Summary

CVE-2026-102489 is a critical session hijacking vulnerability affecting the Zammad helpdesk platform, specifically versions 6.3.0 through 6.5.4. The flaw originates from inadequate protection of session tokens, which allows an attacker to hijack active user sessions. By successfully exploiting this vulnerability, an unauthorized party can execute arbitrary commands as the dedicated `zammad` system user, making it a high-severity issue that threatens the integrity and confidentiality of the entire helpdesk environment ^[1]^[3].

Exploitation

Active Exploitation: The vulnerability has been confirmed as actively exploited in the wild and is listed in the CISA Known Exploited Vulnerabilities (KEV) Catalog ^[5].
Threat Actors/Campaigns: It has been linked to AI-driven network breaches, notably in attacks targeting the Dutch Institute for Vulnerability Disclosure (DIVD), where it was chained with another zero-day (CVE-2026-102490) to escalate privileges to root ^[2]^[4].
Proof-of-Concept: While the vulnerability is being actively exploited in sophisticated campaigns, public-facing, simplified proof-of-concept exploit tools are increasingly associated with such high-profile zero-days post-disclosure ^[2].
Attack Prerequisites: The exploit is considered network-based and can be leveraged by unauthenticated or low-privilege attackers to inject malicious commands by targeting session management weaknesses ^[1].

Affected Products & Patches

Affected Versions: Zammad versions 6.3.0 through 6.5.4 are confirmed to be vulnerable ^[3].
Patch Status: Organizations are advised to check the official Zammad vendor security advisories for the latest patched versions that remediate these session management flaws.
Mitigations: In environments where patching is not immediately feasible, network-level restrictions limiting access to the Zammad instance and monitoring for suspicious session token activity are recommended as temporary mitigations.

Impact

Access/Capabilities: Successful exploitation grants the attacker the ability to hijack user sessions and subsequently execute arbitrary code within the context of the `zammad` system user ^[1].
Business Risk: For internet-facing deployments, this vulnerability poses a severe risk, as it can lead to full system compromise, lateral movement into internal networks, and the exfiltration of sensitive data such as customer contact details and internal communications ^[2]^[4].

Sources

CVE-2026-102489 - Vulnerability Details - OpenCVE
A session hijack flaw in Zammad allows an attacker to take control of a user session and execute arbitrary code as the dedicated zammad system user. The vulnerability originates from inadequate protection of session tokens, enabling an unauthenticated or low‑privilege attacker to inject malicious co…
CVE-2026-102489 - Exploits & Severity - Feedly
The intruders chained two zero-days in the Zammad helpdesk platform, CVE-2026-102489 and CVE-2026-102490, to hijack sessions, execute code remotely and escalate to root within seconds before moving to other services and exfiltrating data, including volunteer email addresses and possibly contact deta…
NVD-CVE-2026-102489
Zammad versions 6.3.0 to 6.5.4 are vulnerable a session hijack vulnerability that leads to remote code execution as the zammad user. The ...
DIVD says Zammad zero-days enabled AI-driven network breach
According to the cybersecurity nonprofit, the two flaws, now identified as CVE-2026-102489 and CVE-2026-102490, enabled session hijacking, remote code execution, and escalation to root privileges.
CISA Adds Four Known Exploited Vulnerabilities to Catalog
CISA has added four new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation.

🔴 CVE-2026-102489