CVE-2026-102489 – Critical Session Hijack Leading to RCE in Zammad

TL;DR

• CVE-2026-102489 is a Critical session hijack flaw in Zammad that can be chained with CVE-2026-102490 to achieve remote code execution as the zammad user and then local privilege escalation to root.
• Actively exploited in the wild; added to CISA KEV on 2026-10-02 with a 3‑day remediation deadline.
• Affected versions: Zammad 6.3.0–6.5.4 (exploitable); present but not exploitable in 7.0.0–7.1.2.
• Immediate action: apply the vendor patch or remove exposed instances from the internet.

Overview

CVE-2026-102489 is a session fixation vulnerability (CWE-384) in the open‑source helpdesk and ticketing platform Zammad. An attacker who can obtain or predict a valid session token can hijack an authenticated session, leading to remote code execution (RCE) under the context of the zammad service account. When combined with the local privilege‑escalation flaw CVE-2026-102490, the chain reaches root privileges in seconds, as observed by the Dutch Institute for Vulnerability Disclosure (DIVD).

Technical details

The flaw resides in the session management component where insufficient validation of session identifiers allows an attacker to set or reuse a session cookie. Successful exploitation requires no authentication (PR:N) and low attack complexity (AC:L) over the network (AV:N). The impact is high on confidentiality, integrity, and availability (C:H/I:H/A:H), yielding a CVSS 3.1 score of 9.8 (Critical).

The vulnerability is present in Zammad versions 6.3.0 through 6.5.4. Versions 7.0.0–7.1.2 contain the same code but are not practically exploitable due to changes in the underlying framework that invalidate the attack vector.

Severity & impact

Affected products

• Zammad (open‑source helpdesk/ticketing platform)
• Versions: 6.3.0–6.5.4 (exploitable); 7.0.0–7.1.2 (present but not exploitable)

For the complete list of affected products, versions, and installation types, see the CVE page.

Actionable insights / What to do

1. Assess exposure – Identify any internet‑facing Zammad instances, especially those running versions 6.3.0–6.5.4.
2. Check for signs of compromise – Review logs for unexpected session tokens, unusual admin activity, or processes spawned by the zammad user.
3. Apply mitigations immediately – If patching cannot be done within the CISA KEV deadline, consider temporarily removing the service from public networks or enforcing strict network segmentation.
4. Monitor for chained attacks – Since CVE-2026-102489 is often used with CVE-2026-102490 to gain root, watch for local privilege‑escalation indicators (e.g., unexpected sudo usage, new root shells).

Remediation & Mitigation (numbered steps)

1. Upgrade – Move to Zammad 7.1.3 or later, where the session fixation issue is resolved.

   # Example for Docker‑based installs
   docker pull zammad/zammad:7.1.3
   docker-compose up -d
   

2. Apply vendor patch – If remaining on a 6.x line, apply the official patch released in the advisory (patch).
   • Advisory URL: https://zammad.com/en/advisories/cve-2026-102489-cve-2026-102490
3. Reset session secrets – After upgrading, invalidate all existing session cookies by rotating the application secret.
4. Enforce MFA – Where possible, require multi‑factor authentication for administrative accounts to reduce the value of a stolen session.
5. Network controls – Restrict access to the Zammad web interface to trusted IP ranges or place it behind a VPN/zero‑trust gateway.
6. Validate with CISA guidance – Follow BOD 26‑04 prioritization and the CISA "Forensics Triage Requirements" referenced in the KEV entry.

References

• Vendor advisory: https://zammad.com/en/advisories/cve-2026-102489-cve-2026-102490
• DIVD advisory: https://csirt.divd.nl/CVE-2026-102489
• DIVD case details: https://csirt.divd.nl/cases/DIVD-2026-00015
• CISA KEV entry: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-102489
• Community discussion: https://community.zammad.org/t/take-care-local-privilege-escalation-cve-2026-102490-is-reported-as-being-actively-exploited/21297
• For key indicators, exploit activity over time, and detailed signal data, see the CVE page.

Bottom line

CVE-2026-102489 is a Critical session hijack flaw in Zammad that is actively exploited and chained with a local priv‑escalation bug to achieve root. Immediate patching or network isolation is required to comply with CISA KEV directives and prevent compromise.

#Zammad #CVE2026102489 #Critical #RCE #CISAKEV #SessionFixation #PrivilegeEscalation