CVE-2026-102489: Zammad GmbH Zammad Session Fixation Vulnerability
CVSS 9.4 · Critical⚠ Actively exploited (CISA KEV)
9.4
CVSS score
Critical
Severity
Active
CISA KEV
No
Ransomware use
Oct 5, 2026
Patch deadline
⚠ Exploited in the wild. CISA added CVE-2026-102489 to its Known Exploited Vulnerabilities catalog on Oct 2, 2026, with a federal patch deadline of Oct 5, 2026 — meaning attackers are actively using it. If you run the affected software, patch it immediately.
Zammad versions 6.3.0 to 6.5.4 are vulnerable a session hijack vulnerability that leads to remote code execution as the zammad user. The bug is also present in version 7.0.0 to version 7.1.2, but not exploitable due to changes in the underlying framework.
Details
AffectedZammad GmbH · Zammad
WeaknessCWE-384
CVSS base score9.4 (Critical)
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:A/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:X/V:C/RE:X/U:XPublishedSep 30, 2026
Added to CISA KEVOct 2, 2026
Federal patch deadlineOct 5, 2026
Known ransomware useNot documented
Frequently asked questions
Is CVE-2026-102489 being actively exploited?
Yes — CISA lists CVE-2026-102489 in its Known Exploited Vulnerabilities (KEV) catalog, so it is confirmed exploited in the wild. Patch it as a priority.
What does CVE-2026-102489 affect?
CVE-2026-102489 affects Zammad GmbH · Zammad.
How do I fix CVE-2026-102489?
Apply the vendor’s patch for the affected software. The federal patch deadline was Oct 5, 2026. Then check whether your personal data was exposed in any related breach.