CVE-2026-102489Critical· 9.8▾ Hadal⚠ Exploited in the wildPoC available

Zammad versions 6.3.0 to 6.5.4 are vulnerable a session hijack vulnerability that leads to remote code execution as the zammad user

Zammad versions 6.3.0 to 6.5.4 are vulnerable a session hijack vulnerability that leads to remote code execution as the zammad user. The bug is also present in version 7.0.0 to version 7.1.2, but not exploitable due to changes in the und…

▾ Hadal zone — Critical and actively exploited (CISA KEV / 0day)

Depth score79/ 100 · Elevated

impact 53.9 · likelihood 0.4 · exploitation 25

⚡ Agent-ready:Raw markdown ↗JSON ↗

Proof of concept

A public proof-of-concept already exists for this vulnerability — see Exploit availability below.

…

Published

Sep 30, 2026

Updated

Oct 10, 2026

CVSS

9.8

Vendor

zammad

Product

zammad

CWE

CWE-384

Depth score

79 · Elevated

EPSS

2.0% · p80

Platforms

—

Source

NVD

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Scores by source

NVD 9.8 · CNA 8.7

Exploit availability

Public exploit / PoC code seen in 1 source. Availability, not in-the-wild use.

checked 2026-10-27

GitHub PoCs

3 public repositories

CISA SSVC

decided 2026-10-02

Exploitation: active
Automatable: yes
Technical impact: total

Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.

EPSS history

Exploit-prediction probability, daily snapshots since Oct 1.

0.7% → 2.0%▲ 1.2%

Timeline

Disclosure to exploitation, from the record and what we observed since indexing it.

9 events · 26 days

Sep 30, 2026Published
Disclosed via NVD
Oct 1, 2026EPSS first tracked
0.7%
Oct 2, 2026Added to CISA KEV
Federal remediation due Oct 5, 2026
Oct 2, 2026Public exploit observed
3 GitHub repos
Oct 2, 2026Exploitation in the wild observed
Oct 2, 2026CVSS changed
8.7 → 9.8
Oct 2, 2026Severity changed
high → critical
Oct 10, 2026Record revised
Last analysed / modified upstream
Oct 26, 2026EPSS peak
0.7% → 2.0%

zammad CWE-384 #nvd #kev #in-the-wild #exploit-available #cve.org

CISA KEVKnown Exploited Vulnerability

Added to the CISA catalog on Oct 2, 2026. Federal remediation due Oct 5, 2026. View catalog ↗

Affected

zammad >= 6.3.0, <= 6.5.4

Patched in

zammad 6.5.4

Full technical detail▾

Overview

Affected

zammad >= 6.3.0, <= 6.5.4

Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

References

Change history

Field changes observed since this record was first indexed.

Oct 3, 2026Added to CISA KEV
Oct 2, 2026Public exploit / PoC published
Oct 2, 2026Exploitation in the wild observed
Oct 2, 2026CVSS 8.7 → 9.8
Oct 2, 2026Severity high → critical

Related vulnerabilities

Connected by shared product, vendor, weakness, or advisory.

#nvd#kev#in-the-wild#exploit-available#cve.org

← Back to feed

CVE-2026-102489Critical· 9.8▾ Hadal⚠ Exploited in the wildPoC available

Zammad versions 6.3.0 to 6.5.4 are vulnerable a session hijack vulnerability that leads to remote code execution as the zammad user

▾ Hadal zone — Critical and actively exploited (CISA KEV / 0day)

Depth score79/ 100 · Elevated

impact 53.9 · likelihood 0.4 · exploitation 25

⚡ Agent-ready:Raw markdown ↗JSON ↗

Proof of concept

A public proof-of-concept already exists for this vulnerability — see Exploit availability below.

…

Published

Sep 30, 2026

Updated

Oct 10, 2026

CVSS

9.8

Vendor

zammad

Product

zammad

CWE

CWE-384

Depth score

79 · Elevated

EPSS

2.0% · p80

Platforms

—

Source

NVD

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Scores by source

NVD 9.8 · CNA 8.7

Exploit availability

Public exploit / PoC code seen in 1 source. Availability, not in-the-wild use.

checked 2026-10-27

GitHub PoCs

3 public repositories

CISA SSVC

decided 2026-10-02

Exploitation: active
Automatable: yes
Technical impact: total

Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.

EPSS history

Exploit-prediction probability, daily snapshots since Oct 1.

0.7% → 2.0%▲ 1.2%

Timeline

Disclosure to exploitation, from the record and what we observed since indexing it.

9 events · 26 days

Sep 30, 2026Published
Disclosed via NVD
Oct 1, 2026EPSS first tracked
0.7%
Oct 2, 2026Added to CISA KEV
Federal remediation due Oct 5, 2026
Oct 2, 2026Public exploit observed
3 GitHub repos
Oct 2, 2026Exploitation in the wild observed
Oct 2, 2026CVSS changed
8.7 → 9.8
Oct 2, 2026Severity changed
high → critical
Oct 10, 2026Record revised
Last analysed / modified upstream
Oct 26, 2026EPSS peak
0.7% → 2.0%

zammad CWE-384 #nvd #kev #in-the-wild #exploit-available #cve.org

CISA KEVKnown Exploited Vulnerability

Added to the CISA catalog on Oct 2, 2026. Federal remediation due Oct 5, 2026. View catalog ↗

Affected

zammad >= 6.3.0, <= 6.5.4

Patched in

zammad 6.5.4

Full technical detail▾

Overview

Affected

zammad >= 6.3.0, <= 6.5.4

Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

References

Change history

Field changes observed since this record was first indexed.

Oct 3, 2026Added to CISA KEV
Oct 2, 2026Public exploit / PoC published
Oct 2, 2026Exploitation in the wild observed
Oct 2, 2026CVSS 8.7 → 9.8
Oct 2, 2026Severity high → critical

Related vulnerabilities

Connected by shared product, vendor, weakness, or advisory.

#nvd#kev#in-the-wild#exploit-available#cve.org