CVE-2026-102489 Zammad GmbH Zammad Session Fixation
Attackers can hijack sessions to execute remote code as the zammad user in affected helpdesk software versions.
- Exploited in the wild
- Since 2 Oct 2026
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2026-102489?
CVE-2026-102489 is a high-severity authentication bypass vulnerability in Zammad Zammad, published on 30 Sep 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Zammad versions 6.3.0 to 6.5.4 are vulnerable a session hijack vulnerability that leads to remote code execution as the zammad user. The bug is also present in version 7.0.0 to version 7.1.2, but not exploitable due to changes in the underlying framework.
Weakness: CWE-384
Which versions are affected by CVE-2026-102489?
It affects 1 product.
Products include Zammad Zammad.
How do I fix CVE-2026-102489?
No fix has been published for CVE-2026-102489 yet. Limit exposure of the affected software until one is available. US federal agencies must fix it by 5 Oct 2026.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2026-102489 being exploited?
Yes. Attackers have exploited CVE-2026-102489 in the wild since at least 2 Oct 2026.
Public exploit code: 3 proofs of concept on GitHub.
Other vulnerabilities in Zammad Zammad
Sources
Also known as GHSA-xmw5-m2wg-4243.