CVE-2026-102489

criticalpriority · act · 90OT risk · criticalKEV · exploitedEU KEV · NCSC-NLEPSS 0.013 · 69 %ileexploit · PoCDENLUS

grimoire priorityP0 · Act now

Exploitable?

Yes · in the wild

CISA KEV · 3 exploits · PoC

Likely / severe?

1.26% (69th) EPSS

CVSS 9.8 · critical

Is it mine?

6 products

Check your exposure

Who says so?

3 sources

cert_bund · ncsc_nl · nvd

added 2026-10-02remediate by 2026-10-05

required action Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

EU KEVflagged by NCSC-NLreported 2026-09-30patched 2026-04-08

Zammad versions 6.3.0 to 6.5.4 are vulnerable a session hijack vulnerability that leads to remote code execution as the zammad user. The vulnerability is also present in version 7.0.0 to version 7.1.3, but not exploitable due to environment conditions.

EPSS · scored 2026-10-23

Zammad GmbH Zammad Session Fixation Vulnerability

Zammad versions 6.3.0 to 6.5.4 are vulnerable a session hijack vulnerability that leads to remote code execution as the zammad user. The bug is also present in version 7.0.0 to version 7.1.2, but not exploitable due to changes in the underlying framework.

cvss

Technical severity, 0–10. One row per scoring source.

9.8

010

base score 0–10 · higher = more severe · hover a vector to decode

v3.19.8criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hprimary · NVD / NIST USexploitability 3.9 · impact 5.9

v4.09.4criticalCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:A/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:X/V:C/RE:X/U:Xsecondary · csirt@divd.nl

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Exploitation: active · Automatable: no · Technical Impact: totalcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-384USprimaryCWE-384US

exploits (3)

Public proof-of-concept and weaponised exploit code.

1xPwn/CVE-2026-102489CVE-2026-102489 exploit in golangPoC · poc_in_github
Hunt-Benito/the-cookie-in-the-error-message-cve-2026-102489-zammad-session-hijack-to-rceHunt-Benito/the-cookie-in-the-error-message-cve-2026-102489-zammad-session-hijack-to-rcePoC · poc_in_github
horizon3ai/CVE-2026-102489Zammad Session Leak to Remote Code ExecutionPoC · poc_in_github

affected products (6)

Products and version ranges known to be affected.

Zammad Zammad <7.2.2all versionscert_bundDE
Zammad Zammad≤ 7.1.3cert_bundDE
Zammad Zammad< 7.1.0-alphacert_bundDE
Zammad Zammad< 7.2.2cert_bundDE
Zammad GmbH Zammad≤ vers:unknown/*ncsc_nlNL
zammad zammad6.3.0 → 6.5.4nvdUScpe:2.3:a:zammad:zammad:*:*:*:*:*:*:*:*

advisories (2)

Vendor and ecosystem advisories describing this.

NCSC-2026-0396Kwetsbaarheden aangetroffen in ZammadNL2026-09-30csaf · ncsc_nlNL
Er zijn twee zeroday-kwetsbaarheden aangetroffen in Zammad.
WID-SEC-W-2026-3694Zammad: Mehrere Schwachstellen ermöglichen Ausführen von beliebigem Programmcode und PrivilegieneskalationDeutsch2026-09-30csaf · cert_bundDE
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Zammad ausnutzen, um beliebigen Programmcode mit Benutzerrechten auszuführen und um Root-Rechte zu erlangen.

sources

Which sources assert this record, and when.

cert_bund ncsc_nl nvd NVD CVE.org MITRE

published 2026-09-30modified 2026-10-10

related (606)

Related entries.

ID	severity	EPSS	exploitable	published
CVE-2018-11714US	critical9.8	67.1% (99th)	Exploit	2018-06-04
An issue was discovered on TP-Link TL-WR840N v5 00000005 0.9.1 3.16 v0001.0 Build 170608 Rel.58696n and TL-WR841N v13 00000013 0.9.1 4.16 v0001.0 Build 170622 Rel.64334n devices. T…
CVE-2018-18925US	critical9.8	31.1% (98th)	Exploit	2018-11-04
Gogs 0.11.66 allows remote code execution because it does not properly validate session IDs, as demonstrated by a ".." session-file forgery in the file session provider in file.go.…
CVE-2017-12965US	critical9.8	15.7% (97th)	Exploit	2017-08-23
Session fixation vulnerability in Apache2Triad 1.5.4 allows remote attackers to hijack web sessions via the PHPSESSID parameter.
CVE-2019-10008US	high8.8	19.4% (97th)	Exploit	2019-04-24
Zoho ManageEngine ServiceDesk 9.3 allows session hijacking and privilege escalation because an established guest session is automatically converted into an established administrato…
CVE-2006-0685US	high10.0	5.23% (92nd)	Exploit	2006-02-15
The check_login function in login.php in Virtual Hosting Control System (VHCS) 2.4.7.1 and earlier does not exit when authentication fails, which allows remote attackers to gain un…

+601 more

references (5) nvd

External citations — patches, advisories, analysis.

https://community.zammad.org/t/take-care-local-privilege-escalation-cve-2026-102490-is-reported-as-being-actively-exploited/21297/2Vendor Advisory
https://csirt.divd.nl/CVE-2026-102489Third Party Advisory
https://csirt.divd.nl/DIVD-2026-00015Third Party Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-102489US Government Resource
https://zammad.com/en/advisories/cve-2026-102489-cve-2026-102490Vendor Advisory

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan