CVE Alert: CVE-2026-102489 – Zammad GmbH

Zammad versions 6.3.0 to 6.5.4 are vulnerable a session hijack vulnerability that leads to remote code execution as the zammad user. The vulnerability is also present in version 7.0.0 to version 7.1.3, but not exploitable due to environment conditions.

**Risk verdict:** Urgent: active exploitation is indicated, so exposed instances should be investigated and remediated promptly.

**Why this matters:** Successful compromise could give an attacker control of the application under its service account, enabling access to support data and changes to tickets or system content. Chaining with the related issue may extend impact beyond the application; the extent depends on the host’s permissions and network access.

**Most likely attack path:** The attack is network-reachable, requires no prior privileges, and has low complexity; passive user interaction may be involved without a deliberate click. The primary impact is within the Zammad service, but a chained attack could affect connected systems or data. The available information does not establish how far an attacker could move laterally in a particular deployment.

**Who is most exposed:** Internet-facing Zammad instances, including self-hosted Linux and Docker deployments, are the key concern. Internal instances may also be reachable through VPNs or compromised networks.

Review authentication logs for unusual session creation, reuse, or source locations.

Look for unexpected child processes launched by Zammad services.

Check host and network telemetry for unusual outbound connections from the application.

Investigate unexpected changes to application files, configuration, or ticket data.

Mitigation and prioritisation:

Identify deployed releases and upgrade to a vendor-confirmed fixed release.

Confirm the exact affected/fixed boundary with the vendor; the supplied version information is not fully clear.

Restrict external access to the service until remediation, where operationally feasible.

Rotate invalidated sessions and review service-account access; preserve logs before cleanup.

Test the upgrade in staging, then expedite production change approval given active exploitation.

A considerable amount of time and effort goes into maintaining this website, creating backend automation and creating new features and content for you to make actionable intelligence decisions. Everyone that supports the site helps enable new functionality.

If you like the site, please support us on Patreon or Buy Me A Coffee using the buttons below.