Vulnerability Details CVE-2026-102489
Zammad versions 6.3.0 to 6.5.4 are vulnerable a session hijack vulnerability that leads to remote code execution as the zammad user. The vulnerability is also present in version 7.0.0 to version 7.1.3, but not exploitable due to environment conditions.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.014
EPSS Ranking 71.5%
CVSS Severity
CVSS v3 Score 9.8
Proposed Action
Zammad GmbH Zammad contains a session fixation vulnerability that can lead to remote code execution as the zammad user. This vulnerability can be chained with CVE-2026-102490.
Ransomware Campaign
Unknown
References
Products affected by CVE-2026-102489
-
cpe:2.3:a:docker:docker:-
-
cpe:2.3:a:zammad:zammad:6.3.0
-
cpe:2.3:a:zammad:zammad:6.3.1
-
cpe:2.3:a:zammad:zammad:6.4.0
-
cpe:2.3:a:zammad:zammad:6.4.1
-
cpe:2.3:a:zammad:zammad:6.4.2
-
cpe:2.3:a:zammad:zammad:6.5.0
-
cpe:2.3:a:zammad:zammad:6.5.2
-
cpe:2.3:a:zammad:zammad:6.5.3
-
cpe:2.3:a:zammad:zammad:7.0.0
-
cpe:2.3:a:zammad:zammad:7.0.1
-
cpe:2.3:a:zammad:zammad:7.1.0
-
cpe:2.3:o:linux:linux_kernel:-