PoC Exploit for Zammad Vulnerability Enables Session Hijacking and RCE

• •CVE-2026-102489 allows session hijacking and remote code execution.
• •The vulnerability was exploited in a breach at the Dutch Institute for Vulnerability Disclosure.
• •Affected Zammad versions range from 6.3.0 to 6.5.4, with a PoC released on October 7.

A proof-of-concept (PoC) exploit for CVE-2026-102489, a vulnerability in Zammad, has been released, allowing unauthenticated attackers to steal session cookies and execute remote code. This flaw was exploited in a September breach at the Dutch Institute for Vulnerability Disclosure (DIVD), where attackers accessed systems using two zero-day vulnerabilities. The PoC, published by Horizon3.ai on October 7, details how an attacker can exploit the Zammad WebSocket endpoint to disclose sensitive session data. The vulnerability arises from improper handling of Ruby WebSocket events, leading to the exposure of connected clients' session information. Affected Zammad versions include 6.3.0 to 6.5.4. DIVD reported that the breach may have exposed volunteer-related data, including email addresses. The investigation is ongoing, and the organization has not confirmed links to known threat actors.