CVE-2026-102489 (CVSS 9.8 Critical): Zammad Session Fixation Leads to Remote Code Execution

What Is the Vulnerability?

CVE-2026-102489 is a session fixation vulnerability (CWE-384) in Zammad, the open-source customer support and ticketing platform developed by Zammad GmbH. Session fixation is a class of flaw where an attacker can establish or predict a valid session identifier before a victim authenticates, then reuse that identifier to take over the authenticated session.

According to NVD, the vulnerability resides in Zammad versions 6.3.0 through 6.5.4. The bug is also present in versions 7.0.0 through 7.1.2, but is not exploitable in that range due to changes in the underlying framework. The exploitable window is therefore specifically the 6.3.x–6.5.x release line.

Critically, CISA's KEV catalog notes that this vulnerability can be chained with CVE-2026-102490, suggesting attackers are combining both flaws to achieve a more impactful attack path culminating in remote code execution (RCE) as the zammad operating-system user.

The CVSS 3.1 base score is 9.8 (Critical) with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, indicating:

• Network-accessible attack surface with no special conditions required.
• No authentication or user interaction needed from the attacker.
• Full confidentiality, integrity, and availability impact upon successful exploitation.

Who and What Is Affected?

Any organisation running a Zammad deployment on the following versions is directly at risk:

• Zammad 6.3.0 through 6.5.4 — vulnerable and exploitable.
• Zammad 7.0.0 through 7.1.2 — vulnerable code present, but not currently exploitable due to framework-level changes (per NVD).

Zammad is commonly deployed as a customer-facing or internal support portal, often accessible over the public internet. Organisations in sectors such as IT services, managed service providers, e-commerce, and government agencies that rely on Zammad for ticketing workflows should treat this as a priority incident.

Because the attack requires no prior authentication and no victim interaction, internet-exposed Zammad instances in the vulnerable version range are at highest risk. Even internal deployments reachable from partially trusted networks (e.g., VPN users, compromised endpoints) warrant urgent attention.

CISA has added this CVE to the Known Exploited Vulnerabilities (KEV) catalog on 2 October 2026, which under BOD 26-04 imposes mandatory remediation timelines for U.S. federal agencies and signals confirmed real-world exploitation activity.

What Is the Potential Impact?

Successful exploitation of CVE-2026-102489 — particularly when chained with CVE-2026-102490 as described in the CISA KEV entry — can result in:

• Remote Code Execution (RCE) as the zammad system user, granting an attacker a foothold on the host running Zammad.
• Full session takeover of any user, including administrators, exposing all support tickets, customer data, and internal communications stored in the system.
• Data confidentiality breach — all ticket content, personally identifiable information, and credentials potentially stored or transmitted through Zammad may be compromised.
• Integrity loss — an attacker with RCE or admin session access can modify ticket data, inject malicious content, or pivot to other internal systems.
• Availability disruption — code execution as the application user may allow an attacker to crash or corrupt the Zammad service and its database.

The combination of a CVSS score of 9.8 and confirmed KEV status means this vulnerability should be treated with the same urgency as a known active incident affecting your infrastructure.

What Should You Do Right Now?

CISA's required action for this KEV entry is to apply mitigations in accordance with vendor instructions, ensuring compliance with BOD 26-04. If mitigations are unavailable, organisations should discontinue use of the product. The following immediate steps are recommended:

1. Identify all Zammad instances in your environment. Check the installed version against the vulnerable range (6.3.0–6.5.4). Do not overlook shadow IT, development environments, or partner-managed deployments.
2. Apply the vendor patch. Consult the official Zammad GmbH security advisories and changelog for the patched release. Follow the vendor's upgrade instructions precisely.
3. Isolate vulnerable instances that cannot be immediately upgraded. Restrict access via firewall rules, reverse-proxy allowlisting, or VPN gating until patching is complete.
4. Invalidate all active sessions after upgrading. Because session fixation may have been exploited prior to patching, existing session tokens should be treated as potentially compromised.
5. Conduct forensic triage per CISA's Forensics Triage Requirements referenced in the KEV entry. Review web server and application logs for anomalous session activity, unexpected code execution, or lateral movement indicators.
6. Assess CVE-2026-102490 simultaneously, as CISA's KEV entry explicitly notes these vulnerabilities are chained in active exploitation.
7. U.S. federal agencies must adhere to BOD 26-04 patching timelines. Review the CISA BOD 26-04 guidance directly at cisa.gov for applicable deadlines.

Primary sources for guidance:

• NVD entry: nvd.nist.gov
• CISA KEV catalog: cisa.gov/known-exploited-vulnerabilities-catalog
• Zammad GmbH official advisories: zammad.com

How Continuous External Testing Surfaces This Exposure

One of the most dangerous characteristics of CVE-2026-102489 is that it is reachable from the internet with no authentication. Organisations often do not know which versions of internet-facing applications they are running until a vulnerability is disclosed — by which point adversaries may already be scanning.

Continuous external attack surface monitoring and vulnerability testing addresses this gap in several ways:

• Version detection: Regular, authenticated and unauthenticated scans of internet-facing assets can identify the specific Zammad version deployed, flagging instances in the 6.3.0–6.5.4 range the moment a critical advisory is published.
• Service enumeration: External network scanning maps all publicly reachable services, including Zammad portals running on non-standard ports or subdomains that internal teams may have forgotten.
• Prioritised alerting: When a CVE enters the CISA KEV catalog with a CVSS score of 9.8, continuous testing platforms can immediately surface all matching exposed assets to security teams, compressing the time-to-remediation window.
• Post-patch verification: After upgrading, an external scan confirms the patched version is now serving requests, ensuring the upgrade was successful end-to-end rather than only on a configuration file.
• Chained vulnerability awareness: Because CVE-2026-102489 is documented as chained with CVE-2026-102490, testing tooling that tracks asset-level vulnerability clusters can alert teams when both flaws are co-present on the same host.

The window between public disclosure and active exploitation continues to compress. For a KEV-listed, authentication-free RCE vulnerability, that window may be measured in hours, not weeks.

Frequently asked questions

Are Zammad versions 7.0.0 through 7.1.2 safe to run?

According to NVD, the vulnerable code is present in versions 7.0.0 through 7.1.2, but it is not exploitable in those versions due to changes in the underlying framework. That said, organisations should still consult Zammad GmbH's official advisories and upgrade to the latest supported release to ensure they receive all security fixes, including any that may address the underlying code defect.

Is this vulnerability being actively exploited?

Yes. CISA added CVE-2026-102489 to the Known Exploited Vulnerabilities catalog on 2 October 2026, which confirms active exploitation has been observed. CISA also notes it can be chained with CVE-2026-102490. Treat any in-scope Zammad deployment as potentially compromised until verified otherwise.

What is a session fixation attack, in plain terms?

In a session fixation attack, an adversary establishes a known session token and tricks or forces the application into associating that token with a legitimate authenticated user. The attacker can then present the same token to the application and be treated as if they are the authenticated user — without ever knowing the user's password. In Zammad's case, this leads to full account takeover and, through the vulnerability chain, remote code execution.

Does this only affect internet-facing Zammad instances?

Internet-facing instances carry the highest immediate risk because the attack requires no authentication or user interaction and is network-accessible. However, internal Zammad deployments reachable from partially trusted segments — such as corporate VPNs, shared cloud environments, or networks where other systems may be compromised — should also be considered at risk and patched with equal urgency.