CVE-2026-102489KEV · OVERDUECWE-384

Zammad GmbH Zammad Session Fixation Vulnerability

Critical · published September 30, 2026

Patch now

Confirmed exploited, and the score agrees

CVSS calls it critical at 9.8. It is confirmed in active exploitation. It sits in the 69.3th percentile for exploit probability.

18
days past CISA
deadline
CVSS v3.1
9.8
EPSS
1%
Percentile
69.3
In the wild
Confirmed
What it is

Zammad versions 6.3.0 to 6.5.4 are vulnerable a session hijack vulnerability that leads to remote code execution as the zammad user. The bug is also present in version 7.0.0 to version 7.1.2, but not exploitable due to changes in the underlying framework.

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
8.7 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:A/AU:Y/V:C
EPSS
0.01255 · 69.3th percentile
Weakness
CWE-384 · Session Fixation
Published
2026-09-30T21:16Z
KEV added
2026-10-02 · due 2026-10-05
Affected products (1)
ProductVersionsFixed in
zammad/zammad≥ 6.3.0, ≤ 6.5.4—
References (5)
https://community.zammad.org/t/take-care-local-privilege-escalation-cve-2026-102490-is-reported-as-being-actively-exploited/21297/2 · [email protected]https://csirt.divd.nl/CVE-2026-102489 · [email protected]https://csirt.divd.nl/DIVD-2026-00015 · [email protected]https://zammad.com/en/advisories/cve-2026-102489-cve-2026-102490 · [email protected]https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-102489 · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 02 OCT 03:41Z
    EPSS moved — → 1%
    epss
  • 02 OCT 00:00Z
    Added to CISA KEV — remediate by Oct 5
    kev
  • 30 SEP 16:21Z
    Undisclosed RCE in Zammad v6.3 and higher
    cvelistv5