Loading vulnerability…
CVE-2026-102489 is a session fixation vulnerability in Zammad that enables session hijacking and can lead to remote code execution as the low-privileged zammad service user. Exploitation is reported in versions 6.3.0 through 6.5.4, although structured affected-version records exclude 6.5.4, leaving that boundary inconsistent. Versions 7.0.0 through 7.1.3 contain the underlying flaw but are reportedly not exploitable because of unspecified environmental conditions. The vulnerable function and detailed exploitation mechanism have not been disclosed. The vulnerability has been actively exploited and can be chained with CVE-2026-102490 to escalate from the zammad account to root.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
No public exploits tracked yet. Mallory keeps watching.
No public exploit code observed for this vulnerability.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
80 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A session fixation vulnerability that can enable remote code execution as the low-privileged Zammad user. Zammad states that exploitation is possible only on unsupported versions 6.5 and earlier; versions 7.0 and later are not affected in practice. It can be chained with CVE-2026-102490 to obtain root access. CISA added it to its Known Exploited Vulnerabilities catalog on October 2, 2026, with an October 5 remediation deadline. The report states that at least one of the two flaws is actively exploited without identifying which one.
A Zammad vulnerability used in the September 21, 2026 breach of DIVD as part of a chain enabling session hijacking, remote code execution as the local zammad user, and subsequent root access. DIVD identifies versions 6.3.0–6.5.4 as affected and says vulnerable code exists in 7.0.0–7.1.3 but environmental conditions prevent exploitation there. Zammad maintains that only unsupported 6.5 and older releases are exploitable and that 7.0 and later are not affected in practice. The vulnerability scores 8.7 individually and 9.4 when chained with CVE-2026-102490. Zammad hardened the relevant code in version 7.2.0.
A high-severity session fixation vulnerability in Zammad, rated CVSS 8.7, that permits remote session hijacking and potentially code execution as the local zammad user. The content reports practical exploitability in versions 6.3.0 through 6.5.4; versions 7.0.0 through 7.1.3 contain the underlying flaw but are reportedly not exploitable because of runtime conditions. It reports active exploitation and addition to CISA's KEV catalog on October 2, 2026. Version 7.2.0 includes security hardening that resolves the vulnerability.
A critical Zammad session-hijacking vulnerability that permits remote command execution in the Zammad service-user context. It was reportedly exploited to compromise DIVD and can be chained with CVE-2026-102490 for root-level access.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.