by Kastro
Paper/Archive/CVE-2026-102489

CVE-2026-102489

Zammad GmbH Zammad — Undisclosed RCE in Zammad v6.3 and higher

KEV · due 5 OctEPSS 22%public exploitSSVC actCVSS 9.8
critical.is priorityof 100
99
CVSS 9.8 (NVD)9.8 / 10 × 3029.4In CISA KEV+3030.0EPSS percentile 97.7.977 × 2019.5Exploit: SSVC active+1010.0SSVC exploitation: active+1010.0
Description · from the CVE record

Zammad versions 6.3.0 to 6.5.4 are vulnerable a session hijack vulnerability that leads to remote code execution as the zammad user. The bug is also present in version 7.0.0 to version 7.1.2, but not exploitable due to changes in the underlying framework.

Affected

ProductAffectedFixed inSource
Zammad6.3.0 – < 6.5.46.5.4CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
DIVD (CNA)9.4CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:A/AU:Y/V:C
CISA ADPSSVCExploitation: active · Automatable: no · Technical impact: total

References

writeupcsirt.divd.nl/DIVD-2026-00015writeupcsirt.divd.nl/CVE-2026-102489advisoryzammad.com/en/advisories/cve-2026-102489-cve-2026-102490writeupcommunity.zammad.org/t/take-care-local-privilege-escalation-cve-2026-102490-is-reported-as-being-actively-exploited/21297/2refcisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-102489kevcisa.gov/known-exploited-vulnerabilities-catalog