Zammad: CVE-2026-102489 exploited, from session hijack to RCE

On 30 September 2026 CVE-2026-102489 was published: a critical vulnerability in Zammad, the web-based helpdesk and ticketing platform. On the same day NCSC-NL, the Dutch national cyber security centre, issued advisory NCSC-2026-0396 on vulnerabilities found in Zammad, with the highest rating on its scale: H/H, high likelihood and high impact.

On 2 October CISA added CVE-2026-102489 to its Known Exploited Vulnerabilities (KEV) catalogue, which means the vulnerability is already being exploited in real attacks. The deadline for US federal agencies to act was 5 October.

What happened

According to the description published in the NVD database, Zammad versions 6.3.0 to 6.5.4 are vulnerable to a session hijack that leads to remote code execution with the privileges of the zammad user, the account the application runs as.

The flaw is also present in versions 7.0.0 to 7.1.2, but according to the same description it cannot be exploited there, because of changes in the underlying framework.

The NCSC-NL advisory refers to vulnerabilities in the plural, and the vendor advisory listed among the NVD references covers two CVEs: CVE-2026-102489 and CVE-2026-102490. For the second one, the available sources only offer the title of a Zammad post in its community forum: a local privilege escalation, reported as actively exploited. The sources do not give affected versions or details for this second vulnerability, nor do they say whether the two are used together.

Technical details

• CVE: CVE-2026-102489.
• Weakness: CWE-384 (Session Fixation). The KEV catalogue indeed calls it a “Session Fixation Vulnerability”, while the NVD description speaks of a session hijack.
• Affected and exploitable versions: Zammad 6.3.0 to 6.5.4.
• Versions with the flaw but not exploitable: 7.0.0 to 7.1.2.
• Impact: remote code execution as the zammad user.
• CVSS scores, with one difference worth noting:
  • 9.8 (critical) in CVSS 3.1, scored by NIST: network attack, low complexity, no privileges and no user interaction required;
  • 9.4 (critical) in CVSS 4.0, scored by the Dutch CSIRT DIVD: network attack, no privileges, but with passive user interaction (UI:P). The vector also reports exploitation already observed (E:A).
• Exploitation: confirmed by CISA through the KEV listing. According to CISA, use in ransomware campaigns is currently unknown.
• MITRE ATT&CK: exploiting a web application reachable over the network maps to T1190 (Exploit Public-Facing Application). The sources do not describe the attack chain or any indicators of compromise.

The two scores differ on user interaction: NIST says none is needed, DIVD says passive interaction is required. In both cases the attacker needs no credentials.

Impact for European and Italian organisations

A helpdesk holds tickets, emails, attachments and personal data of customers and employees, and is often connected to mailboxes and other business systems. Running code with the application’s privileges means being able to act on everything the application can reach. That is why a vulnerability of this kind, already exploited and requiring no credentials, should be treated as urgent, starting with instances reachable from the Internet.

For entities in scope of NIS2, timely vulnerability handling is part of the required measures, and a compromise must be assessed for notification to the national CSIRT, which in Italy is CSIRT Italia at ACN. If the helpdesk holds personal data, unauthorised access must also be assessed under the GDPR.

What to do now

1. Inventory: identify every Zammad instance and its installed version, and check which ones are reachable from the Internet. Versions 6.3.0 to 6.5.4 come first.
2. Update: follow Zammad’s advisory on CVE-2026-102489 and CVE-2026-102490 and move every instance to a fixed version, starting with the exposed ones. The available sources do not state the fixed version number: check it in the advisory. CISA asks organisations to apply the vendor’s mitigations or, if none are available, to stop using the product.
3. 7.x versions: even though the flaw cannot be exploited in 7.0.0 to 7.1.2, check the vendor advisory for guidance on these branches.
4. Reduce exposure: until the update is in place, consider making the helpdesk reachable only from the internal network or through a VPN.
5. Look for signs of compromise: for federal agencies, CISA points to its forensics triage requirements. On instances that were exposed while running a vulnerable version, review application and server logs, processes and commands started by the zammad user, and changes to the application’s files.
6. Sessions and credentials: after updating, terminate active sessions and, if you find signs of compromise, replace the credentials and tokens Zammad uses for its integrations.
7. Follow CVE-2026-102490: keep an eye on the vendor advisory for details on the privilege escalation.

How ARXDOME helps

ARX Expose shows which services your company exposes on the Internet, which products are recognised on them and which have known vulnerabilities: it helps you find out whether a Zammad helpdesk can be reached from outside. ARX Shield lists the open vulnerabilities on monitored machines and highlights those already exploited by attackers. ARX Sentry collects logs and events from the servers where the agent is installed and checks file integrity in the folders you choose. With ARX Horizon you can look up vulnerability details and search for indicators of compromise from the portal.

Last updated: 2 October 2026