CVE-2026-102489

KEV catalog · CISA Known Exploited Vulnerabilities

CVE-2026-102489

Zammad GmbH · Zammad · Added 2026-10-02 · Published 2026-09-30

3-Day Required KEV Active Exploitation

Details

VulnerabilityZammad GmbH Zammad Session Fixation Vulnerability

VendorZammad GmbH

ProductZammad

Date added2026-10-02

Due date2026-10-05

CISA catalogView on CISA KEV catalog

Required actionApply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

CWECWE-280

Descriptions

KEV: Zammad GmbH Zammad contains a session fixation vulnerability that can lead to remote code execution as the zammad user. This vulnerability can be chained with CVE-2026-102490.

NVD: Zammad versions 6.3.0 to 6.5.4 are vulnerable a session hijack vulnerability that leads to remote code execution as the zammad user. The vulnerability is also present in version 7.0.0 to version 7.1.3, but not exploitable due to environment conditions.

Compliance SSVC + BOD 26-04

Automatableno

Technical impacttotal

Exploitation statusactive

3-day qualifyingYes

Public timeline3 days + forensic

Non-public timeline14 days

Forensic (public)Required

Forensic (non-public)Not required

Research metadata

Last researched2026-10-02 17:00 UTC

Wall time0.5s

Searches14

Component defaultyes — session handling is core functionality of the Zammad web application and cannot be disabled; the web UI ships in every standard package and Docker deployment, which is the default install shape DIVD's IOC script targets (/var/log/zammad + /var/log/nginx)

Sources https://csirt.divd.nl/DIVD-2026-00015
https://csirt.divd.nl/CVE-2026-102489
https://csirt.divd.nl/cases/DIVD-2026-00014/
https://csirt.divd.nl/downloads/DIVD-2026-00015/cve-2026-102489_ioc_check_script_v2.sh
https://advisories.ncsc.nl/2026/ncsc-2026-0396.html
https://www.ncsc.nl/alerts/actief-misbruik-van-zeroday-kwetsbaarheden-in-zammad-update-nu
https://github.com/advisories/GHSA-xmw5-m2wg-4243
https://zammad.com/en/advisories
https://zammad.com/en/product/releases
https://ftp.zammad.com/
https://nvd.nist.gov/vuln/detail/CVE-2026-102489

QC notes

warn component_extraction: Component 'Zammad web application session handling — session fixation in web-UI session processing of the Rails app (specific endpoint not disclosed in the public advisory)' matches or contains product name 'Zammad' — no specific component identified

Hunting hypothesis agent

Hunt Zammad Rails logs (production.log/railsserver.log) and nginx access logs for ERROR lines leaking session material ("Cookie"=>"...", @clients={) during CVE-2026-102489 session-fixation attempts on the unauthenticated web UI.

Research details

ComponentZammad web application session handling — session fixation in web-UI session processing of the Rails app (specific endpoint not disclosed in the public advisory)

PreconditionsNetwork reachability to the Zammad web UI; no authentication required (CVSS v4 PR:N), with passive user interaction scored as UI:P. Exploitable in Zammad 6.3.0 through 6.5.4 on Linux/Docker; the flaw is present in 7.0.0 through 7.1.3 but is not exploitable there due to environment conditions. Chaining with CVE-2026-102490 (still unpatched) escalates from the zammad user to root; NCSC-NL says a Zammad security update exists for this CVE. agent

Deliverynetwork_exploit (unauthenticated HTTP requests to the Zammad web UI)

Public PoCno

Advisoryhttps://csirt.divd.nl/DIVD-2026-00015

Exploit notesUnauthenticated network exploitation of the Zammad web UI (CVSS:4.0 AV:N/AC:L/PR:N/UI:P, E:A; DIVD base 8.7 standalone, 9.4 chained with CVE-2026-102490). No public weaponized exploit exists: GitHub repository and code searches for the CVE return only CVE datasets, news and tracking pages, and no Nuclei template is published. DIVD's only public artifact is a detection-oriented log-check script (cve-2026-102489_ioc_check_script_v2.sh) that greps Zammad Rails and nginx logs for session material in error output — detection tooling, not exploit code. Trigger mechanics remain undisclosed; in the wild, an agentic-AI attacker chained session hijack to RCE as the zammad user and then to root via CVE-2026-102490 within seconds (DIVD breach, 2026-09-21).

SummarySession fixation in Zammad's web session handling lets an unauthenticated network attacker hijack sessions and gain remote code execution as the zammad OS user (exploitable in Zammad 6.3.0–6.5.4; present but not exploitable in 7.0.0–7.1.3 due to environment conditions). DIVD disclosed the flaw after two zero-days were used to breach its own network on 2026-09-21, chaining this CVE with the local privilege escalation CVE-2026-102490 to reach root in seconds; CISA added it to KEV on 2026-10-02 (due 2026-10-05). No public exploit code exists — DIVD published only a detection-oriented IOC log-check script — and NCSC-NL states Zammad released a security update, though no CVE-specific vendor advisory page is publicly posted yet.

Tia coverage

First reported2026-09-29

First exploit report2026-09-30

Exploit report → KEV2 days before the listing

When Tia's reporting first covered this CVE and whether a report claimed exploitation before the KEV listing. Lead-time deltas are measured from the exploitation report only — plain coverage is not exploitation intel. See the story links under Mentioned in for coverage detail.

Mentioned in

automated-ai-agent-used-to-breach-cybersecurity-nonprofit-divd zammad-critical-vulnerabilities-enable-remote-code-execution-and

Record schema v1.0. Enrichment is research-grade, not a substitute for analyst review.