Zammad session hijack allows remote code execution without credentials (CVE-2026-102489)

What happened

CVE-2026-102489 is a session hijack vulnerability in Zammad. The CVSS 4.0 vector records a network attack with low complexity and no privileges required, with passive user interaction. Successful exploitation gives an attacker remote code execution as the zammad user, with high impact on confidentiality, integrity and availability of the vulnerable system and subsequent systems.

CISA's Known Exploited Vulnerabilities Catalog lists this CVE as exploited, and CISA's SSVC assessment records active exploitation with automatable yes and technical impact total. No vendor advisory or vendor workaround is listed in the public references.

Who is affected

The affected listing is Zammad versions 6.3.0 to before 6.5.4. The CVE description also notes the vulnerability is present in 7.0.0 through 7.1.3, but states it is not exploitable due to environment conditions. Because the CVSS vector lists a network attack with no privileges required, any Zammad installation reachable from an untrusted network should be treated as the priority.

What to do now

1. Upgrade affected Zammad installations to the fixed release, Zammad 6.5.4. CISA's KEV due date is 5 October 2026.
2. If an immediate upgrade is not possible, restrict network access to Zammad, prioritising any internet-facing instance, and monitor for unexpected processes running as the zammad user.
3. Review CISA's KEV entry for the full required action, including BOD 26-04 guidance and the forensics triage requirements it references. No vendor workaround is listed in the public references.

How to detect it

No vendor indicators of compromise are provided. Because the vulnerability leads to remote code execution as the zammad user, check Zammad hosts for unexpected processes, file changes or new services under that account. Review session logs for unexplained activity on internet-facing Zammad instances.

Beyond the patch

Beyond patching, CISA's active exploitation record means detection and response matter for any Zammad instance that may already be affected. Our Managed Detection & Response (MDR) watches for post-exploitation activity, and Virtual CISO Services (vCISO) helps identify and reduce network-exposed Zammad instances before they are exploited.