---
id: CVE-2026-102489
title: >-
  Zammad versions 6.3.0 to 6.5.4 are vulnerable a session hijack vulnerability
  that leads to remote code execution as the zammad user
summary: >-
  Zammad versions 6.3.0 to 6.5.4 are vulnerable a session hijack vulnerability
  that leads to remote code execution as the zammad user. The bug is also
  present in version 7.0.0 to version 7.1.2, but not exploitable due to changes
  in the und…
severity: critical
cvss: 9.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-384
vendor: zammad
product: zammad
affected:
  - 'zammad >= 6.3.0, <= 6.5.4'
patched:
  - zammad 6.5.4
published: '2026-09-30'
updated: '2026-10-10'
sourceUpdated: '2026-10-10T04:18:08.040'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-102489'
references:
  - url: >-
      https://community.zammad.org/t/take-care-local-privilege-escalation-cve-2026-102490-is-reported-as-being-actively-exploited/21297/2
    label: csirt@divd.nl
  - url: 'https://csirt.divd.nl/CVE-2026-102489'
    label: csirt@divd.nl
  - url: 'https://csirt.divd.nl/DIVD-2026-00015'
    label: csirt@divd.nl
  - url: 'https://zammad.com/en/advisories/cve-2026-102489-cve-2026-102490'
    label: csirt@divd.nl
  - url: >-
      https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-102489
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
tags:
  - nvd
  - kev
  - in-the-wild
  - exploit-available
  - cve.org
epss: 0.01955
epssPercentile: 0.80161
kev: true
kevDateAdded: '2026-10-02'
kevDueDate: '2026-10-05'
kevRansomware: false
exploited: true
exploits:
  github: 3
  githubRepos:
    - 'https://github.com/horizon3ai/CVE-2026-102489'
    - 'https://github.com/1xPwn/CVE-2026-102489'
    - >-
      https://github.com/Hunt-Benito/the-cookie-in-the-error-message-cve-2026-102489-zammad-session-hijack-to-rce
  checkedAt: '2026-10-27T16:53:30.610Z'
exploitAvailable: true
ssvc:
  exploitation: active
  automatable: 'yes'
  technicalImpact: total
  timestamp: '2026-10-02T16:27:26.039890Z'
scores:
  nvd: 9.8
  cna: 8.7
ingestedAt: '2026-09-30T17:13:20.840Z'
---

## Overview

Zammad versions 6.3.0 to 6.5.4 are vulnerable a session hijack vulnerability that leads to remote code execution as the zammad user. The bug is also present in version 7.0.0 to version 7.1.2, but not exploitable due to changes in the underlying framework.

## Affected

- `zammad >= 6.3.0, <= 6.5.4`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.