# Zammad session hijack zero-day that led to remote code execution

Source: https://startwithidentity.com/cves/cve-2026-102489/
Last updated: 2026-11-05
License: content by Start with Identity. Cite the source URL.

---

## What broke

CVE-2026-102489 is a session hijack in the Zammad help desk that leads to remote code execution as the `zammad` service user. NVD lists Zammad 6.3.0 to 6.5.4 as vulnerable and says the bug is also present in 7.0.0 to 7.1.2 but not exploitable there because of changes in the underlying framework. NVD scores it CVSS 3.1 9.8 and maps it to CWE-384 (session fixation), the CWE CISA also lists. Neither DIVD nor Zammad has published how the session is fixed or taken over.

The Dutch Institute for Vulnerability Disclosure (DIVD) found it after its own Zammad instance was breached. DIVD published its advisory on September 29, 2026 and said the bug, chained with the local privilege escalation CVE-2026-102490, let attackers "hijack sessions, run code remotely, and escalate privileges." CISA added both CVEs to KEV on October 2, 2026. Zammad's October 5 advisory says only 6.5 and older are exploitable in practice and that the hardening is in Zammad 7.2.0. Zammad 6.5 and older no longer receive security fixes.

## Why it matters

A help desk holds the conversations where password resets, MFA re-enrollment and access requests happen. An attacker who takes over an agent's session reads those tickets as that agent and can act on them, without ever learning a password or passing MFA. Here the hijacked session was also the step to code on the server, and from there DIVD says the attacker reached other services. Session state is part of the authentication system, not plumbing beneath it. See [session hijacking](https://startwithidentity.com/glossary/session-hijacking/).

## What to do

- Upgrade to Zammad 7.2.0. If you run 6.5 or older and cannot upgrade, take the instance off the internet.
- Restrict shell access to the Zammad host to trusted administrators, as Zammad advises, which limits the CVE-2026-102490 escalation.
- Put the agent interface behind your IdP with SSO and a short session lifetime.

## After you patch

- End all active Zammad sessions and rotate API tokens and any integration credentials stored in Zammad (mail accounts, LDAP bind, chat and telephony connectors).
- Review tickets touched since September 2026 for password reset or account change requests that agents did not make.

## Sources

- [NVD: CVE-2026-102489](https://nvd.nist.gov/vuln/detail/cve-2026-102489)
- [Zammad security advisory for CVE-2026-102489 and CVE-2026-102490](https://zammad.com/en/advisories/cve-2026-102489-cve-2026-102490)
- [DIVD advisory: CVE-2026-102489](https://csirt.divd.nl/cves/CVE-2026-102489/)
- [BleepingComputer: DIVD says Zammad zero-days enabled AI-driven network breach](https://www.bleepingcomputer.com/news/security/divd-says-zammad-zero-days-enabled-ai-driven-network-breach/)
- [CISA Known Exploited Vulnerabilities catalog, added October 2, 2026](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-102489)