Description
Zammad versions 6.3.0 to 6.5.4 are vulnerable a session hijack vulnerability that leads to remote code execution as the zammad user. The bug is also present in version 7.0.0 to version 7.1.2, but not exploitable due to changes in the underlying framework.
Metrics
CVSS 3.1 9.8/10
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HWeakness enumeration
Affected software
| Vendor | Product | Versions |
|---|---|---|
| Zammad GmbH | Zammad | >= 6.3.0, < 6.5.4 |
References
- https://community.zammad.org/t/take-care-local-privilege-escalation-cve-2026-102490-is-reported-as-being-actively-exploited/21297/2Vendor Advisory
- https://csirt.divd.nl/CVE-2026-102489Third Party Advisory
- https://csirt.divd.nl/DIVD-2026-00015Third Party Advisory
- https://zammad.com/en/advisories/cve-2026-102489-cve-2026-102490Vendor Advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-102489US Government Resource
Timeline
- Published
- Sep 30, 2026
- Last modified
- Oct 10, 2026
- Added to CISA KEV
- Oct 2, 2026
- NVD status
- Analyzed