CVE-2026-102489Zammad session hijack zero-day that led to remote code execution
What broke
CVE-2026-102489 is a session hijack in the Zammad help desk that leads to remote code execution as the zammad service user. NVD lists Zammad 6.3.0 to 6.5.4 as vulnerable and says the bug is also present in 7.0.0 to 7.1.2 but not exploitable there because of changes in the underlying framework. NVD scores it CVSS 3.1 9.8 and maps it to CWE-384 (session fixation), the CWE CISA also lists. Neither DIVD nor Zammad has published how the session is fixed or taken over.
The Dutch Institute for Vulnerability Disclosure (DIVD) found it after its own Zammad instance was breached. DIVD published its advisory on September 29, 2026 and said the bug, chained with the local privilege escalation CVE-2026-102490, let attackers "hijack sessions, run code remotely, and escalate privileges." CISA added both CVEs to KEV on October 2, 2026. Zammad's October 5 advisory says only 6.5 and older are exploitable in practice and that the hardening is in Zammad 7.2.0. Zammad 6.5 and older no longer receive security fixes.
Why it matters
A help desk holds the conversations where password resets, MFA re-enrollment and access requests happen. An attacker who takes over an agent's session reads those tickets as that agent and can act on them, without ever learning a password or passing MFA. Here the hijacked session was also the step to code on the server, and from there DIVD says the attacker reached other services. Session state is part of the authentication system, not plumbing beneath it. See session hijacking.
What to do
- Upgrade to Zammad 7.2.0. If you run 6.5 or older and cannot upgrade, take the instance off the internet.
- Restrict shell access to the Zammad host to trusted administrators, as Zammad advises, which limits the CVE-2026-102490 escalation.
- Put the agent interface behind your IdP with SSO and a short session lifetime.
After you patch
- End all active Zammad sessions and rotate API tokens and any integration credentials stored in Zammad (mail accounts, LDAP bind, chat and telephony connectors).
- Review tickets touched since September 2026 for password reset or account change requests that agents did not make.
Sources
Related on Start with Identity
- CVEBeyondTrust Remote Support zero-day, from file upload to the whole credential vault
An origin-validation flaw in self-hosted BeyondTrust Remote Support through 26.2.3 let ARMORY CASTLE plant a web shell, export every vaulted admin credential, a
- BlogCISA adds the last two Ivanti Connect Secure chain flaws to KEV after Ivanti's October 29 patch
CISA added Ivanti Connect Secure CVE-2026-111357 and CVE-2026-118527 to its exploited list on October 30, a day after Ivanti patched the root escalation UTA0576
- CVECommvault Web Server zero-day that exposed Metallic Microsoft 365 app secrets
An authenticated webshell flaw in Commvault Web Server, used as a zero-day in Commvault's Azure environment, where the actor may have reached client secrets cus
- CVEF5 BIG-IP APM heap overflow in the OAuth authorization server, exploited as a zero-day
BIG-IP APM configured as an OAuth authorization server had a heap overflow that unauthenticated traffic could turn into remote code execution. CVSS 9.8, exploit
- BlogIvanti Connect Secure auth bypass exploited; CISA gave agencies three days
CVE-2026-104935 lets an unauthenticated attacker bypass Ivanti Connect Secure's login with a crafted header and run commands. Exploited since early October by a
- BlogRemote access appliances are credential vaults, so patch day has to be rotation day
Four October disclosures about BeyondTrust, Ivanti and Fortinet gateways all ended the same way: the attacker left with the credentials the box was holding. A p