CRITICALCVSS 9.4KNOWN EXPLOITED

CVE-2026-102489

CVE-2026-102489 updated by NVD

Published: 2026-10-02
Modified: 2026-11-04
Sources: cisa-kev, nvd

Summary

Zammad versions 6.3.0 to 6.5.4 are vulnerable a session hijack vulnerability that leads to remote code execution as the zammad user. The bug is also present in version 7.0.0 to version 7.1.2, but not exploitable due to changes in the underlying framework.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-102489

Includes data from the CISA Known Exploited Vulnerabilities catalog.

Includes data from the National Vulnerability Database (NIST). NVD data is in the public domain; this page is not endorsed by NIST.

CVE® is a registered trademark of The MITRE Corporation. CVE content reproduced under the CVE Terms of Use; copyright designation © MITRE.