CVE-2026-102489

Undisclosed RCE in Zammad v6.3 and higher

8.7 HighIn KEVPublic exploit

CVE-2026-102489 is a high vulnerability (CVSS 8.7) in Zammad, published September 30, 2026. CISA lists it as known to be exploited, since October 2, 2026. EUVD reports exploitation since September 30, 2026. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 22.5%, the 97th percentile. No source names a fixed version.

Zammad versions 6.3.0 to 6.5.4 are vulnerable a session hijack vulnerability that leads to remote code execution as the zammad user. The bug is also present in version 7.0.0 to version 7.1.2, but not exploitable due to changes in the underlying framework.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: Passive

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

22.5%Up 21.8 points since Oct 1, 2026

What each source reports

CVE List Score used 8.7

Undisclosed RCE in Zammad v6.3 and higher

Record: CVE-2026-102489
CVSS 4.0: 8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:A/AU:Y/V:C
CVSS 4.0: 9.4 CriticalCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:A/AU:Y/V:C
Weakness: CWE-384
Updated: 2026-11-02

EUVDEUVD-2026-90080 9.4

Record: EUVD-2026-90080
CVSS 4.0: 9.4 CriticalCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:A/AU:Y/V:C
Updated: 2026-11-02

GitHub AdvisoriesGHSA-xmw5-m2wg-4243 9.4

Zammad versions 6.3.0 to 6.5.4 are vulnerable a session hijack vulnerability that leads to remote...

Zammad versions 6.3.0 to 6.5.4 are vulnerable a session hijack vulnerability that leads to remote code execution as the zammad user. The vulnerability is also present in version 7.0.0 to version 7.1.3, but not exploitable due to environment conditions.

Record: GHSA-xmw5-m2wg-4243
CVSS 4.0: 9.4 CriticalCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:A/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:X/V:C/RE:X/U:X
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-384
Updated: 2026-11-02

CISA KEV No score

Zammad GmbH Zammad Session Fixation Vulnerability

Zammad GmbH Zammad contains a session fixation vulnerability that can lead to remote code execution as the zammad user. This vulnerability can be chained with CVE-2026-102490.

Record: CVE-2026-102489
Weakness: CWE-384
Updated: 2026-11-02

NVD 9.4

Record: CVE-2026-102489
CVSS 4.0: 9.4 CriticalCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:A/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:X/V:C/RE:X/U:X
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-384
Updated: 2026-11-02

Affected products

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
Source	Link	Date
PoC in GitHub	horizon3ai/CVE-2026-102489	2026-10-06
PoC in GitHub	1xPwn/CVE-2026-102489	2026-10-11

History

History
When	Changed	Sources
2026-11-03	exploits	PoC in GitHub
2026-11-03	exploitation, exploits
2026-11-02	created	CVE List, EUVD, GitHub Advisories, CISA KEV, NVD, PoC in GitHub