CVE-2026-102489

EUVD-2026-90080
Zammad versions 6.3.0 to 6.5.4 are vulnerable a session hijack vulnerability that leads to remote code execution as the zammad user. The bug is also present in version 7.0.0 to version 7.1.2, but not exploitable due to changes in the underlying framework.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
9.8 CRITICAL
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 98.92%
Affected Products (NVD)
VendorProductVersion
zammadzammad
6.3.0 ≤
𝑥
≤ 6.5.4
𝑥
= Vulnerable software versions
Common Weakness Enumeration
Vulnerability Media Exposure
References
https://community.zammad.org/t/take-care-local-privilege-escalation-cve-2026-102490-is-reported-as-being-actively-exploited/21297/2
https://csirt.divd.nl/CVE-2026-102489
https://csirt.divd.nl/DIVD-2026-00015
https://zammad.com/en/advisories/cve-2026-102489-cve-2026-102490
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-102489