CVE-2026-102489 (GCVE-0-2026-102489)

Vulnerability from cvelistv5 – Published: 2026-09-30 16:21 – Updated: 2026-09-30 16:21
VLAI ENISA
Title
Undisclosed RCE in Zammad v6.3 and higher
Summary
Zammad versions 6.3.0 to 6.5.4 are vulnerable a session hijack vulnerability that leads to remote code execution as the zammad user. The vulnerability is also present in version 7.0.0 to version 7.1.3, but not exploitable due to environment conditions.
Severity
8.7 (High)
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:A/AU:Y/V:C
9.4 (Critical)
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:A/AU:Y/V:C
Assigner
References
URL Tags
https://csirt.divd.nl/DIVD-2026-00015 third-party-advisory
https://csirt.divd.nl/CVE-2026-102489 third-party-advisory
Impacted products
Vendor Product Version CPE status
Zammad GmbH Zammad Unknown: * , < 6.3.0 (semver)
Affected: 6.3.0 , < 6.5.4 (semver)
Unaffected: 7.0.0 , < * (semver)
guessed Create a notification for this product.
Date Public
2026-09-29 20:00
Credits
Earth Grob (Merlon Security) Luke paris (Merlon Security) Tijmen van der Spijk (Merlon Security) Zohar Cochavi (Merlon Security) Alje Woltjer (Merlon Security) Mischa Rick van Geelen (DIVD) Ralph Horn (DIVD) Max van der Horst (DIVD) Victor Pasman (DIVD) Frank Breedijk (DIVD)
ENISA
Known Exploited Vulnerability - GCVE BCP-07 Compliant
KEV entry ID: 8227a228-d30d-4abb-9c78-64ef4ab79579

Vulnerability ID: CVE-2026-102489

Status: Confirmed

Status Updated: 2026-09-30 00:00 UTC

Exploited: Yes

Timestamps
First Seen: 2026-09-30
Asserted: 2026-09-30
Scope
Notes: Affected: Zammad / Zammad | Description: Zammad versions 6.3.0 to 6.5.4 are vulnerable a session hijack vulnerability that leads to remote code execution as the zammad user. The vulnerability is also present in version 7.0.0 to version 7.1.3, but not exploitable due to environment conditions. | Patched since: 2026/04/08 | Exploitation type: unknown | Origin source: NCSC-NL | Notes: https://www.ncsc.nl/alerts/actief-misbruik-van-zeroday-kwetsbaarheden-in-zammad-update-nu
Evidence

Type: Csirt Report

Signal: Successful Exploitation

Confidence: 75%

Source: enisa-cnw-kev

Details
Cwes
Euvd EUVD-2026-90080
Notes https://www.ncsc.nl/alerts/actief-misbruik-van-zeroday-kwetsbaarheden-in-zammad-update-nu
Catalog ENISA / EU CSIRTs Network (CNW) KEV JSON
Product Zammad
Datereported 2026/09/30
Originsource NCSC-NL
Patchedsince 2026/04/08
Vendorproject Zammad
Exploitationtype unknown
Vulnerabilityname
Threatactorsexploiting
References
Created: 2026-10-01 08:00 UTC | Updated: 2026-10-01 08:00 UTC
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "platforms": [
            "Linux",
            "Docker"
          ],
          "product": "Zammad",
          "vendor": "Zammad GmbH",
          "versions": [
            {
              "lessThan": "6.3.0",
              "status": "unknown",
              "version": "*",
              "versionType": "semver"
            },
            {
              "lessThan": "6.5.4",
              "status": "affected",
              "version": "6.3.0",
              "versionType": "semver"
            },
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "7.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Earth Grob (Merlon Security)"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "Luke paris (Merlon Security)"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "Tijmen van der Spijk (Merlon Security)"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "Zohar Cochavi (Merlon Security)"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "Alje Woltjer (Merlon Security)"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "Mischa Rick van Geelen (DIVD)"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "Ralph Horn (DIVD)"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "Max van der Horst (DIVD)"
        },
        {
          "lang": "en",
          "type": "analyst",
          "value": "Victor Pasman (DIVD)"
        },
        {
          "lang": "en",
          "type": "analyst",
          "value": "Frank Breedijk (DIVD)"
        }
      ],
      "datePublic": "2026-09-29T20:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Zammad versions 6.3.0 to 6.5.4 are vulnerable a session hijack vulnerability that leads to remote code execution as the zammad user. The vulnerability is also present in version 7.0.0 to version 7.1.3, but not exploitable due to environment conditions."
            }
          ],
          "value": "Zammad versions 6.3.0 to 6.5.4 are vulnerable a session hijack vulnerability that leads to remote code execution as the zammad user. The vulnerability is also present in version 7.0.0 to version 7.1.3, but not exploitable due to environment conditions."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "YES",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "exploitMaturity": "ATTACKED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "LOW",
            "subConfidentialityImpact": "LOW",
            "subIntegrityImpact": "LOW",
            "userInteraction": "PASSIVE",
            "valueDensity": "CONCENTRATED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:A/AU:Y/V:C",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        },
        {
          "cvssV4_0": {
            "Automatable": "YES",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 9.4,
            "baseSeverity": "CRITICAL",
            "exploitMaturity": "ATTACKED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "HIGH",
            "subConfidentialityImpact": "HIGH",
            "subIntegrityImpact": "HIGH",
            "userInteraction": "PASSIVE",
            "valueDensity": "CONCENTRATED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:A/AU:Y/V:C",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "Chained with CVE-2026-102490"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-30T16:21:19.937Z",
        "orgId": "b87402ff-ae37-4194-9dae-31abdbd6f217",
        "shortName": "DIVD"
      },
      "references": [
        {
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://csirt.divd.nl/DIVD-2026-00015"
        },
        {
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://csirt.divd.nl/CVE-2026-102489"
        }
      ],
      "source": {
        "advisory": "DIVD-2026-00015",
        "discovery": "INTERNAL"
      },
      "title": "Undisclosed RCE in Zammad v6.3 and higher",
      "x_generator": {
        "engine": "Vulnogram 1.0.5"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b87402ff-ae37-4194-9dae-31abdbd6f217",
    "assignerShortName": "DIVD",
    "cveId": "CVE-2026-102489",
    "datePublished": "2026-09-30T16:21:19.937Z",
    "dateReserved": "2026-09-29T09:46:12.490Z",
    "dateUpdated": "2026-09-30T16:21:19.937Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "platforms": [
                  "Linux",
                  "Docker"
                ],
                "product": "Zammad",
                "vendor": "Zammad GmbH",
                "versions": [
                  {
                    "lessThan": "6.3.0",
                    "status": "unknown",
                    "version": "*",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "6.5.4",
                    "status": "affected",
                    "version": "6.3.0",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "*",
                    "status": "unaffected",
                    "version": "7.0.0",
                    "versionType": "semver"
                  }
                ]
              }
            ],
            "source": "csirt@divd.nl"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "Zammad versions 6.3.0 to 6.5.4 are vulnerable a session hijack vulnerability that leads to remote code execution as the zammad user. The vulnerability is also present in version 7.0.0 to version 7.1.3, but not exploitable due to environment conditions."
          }
        ],
        "id": "CVE-2026-102489",
        "lastModified": "2026-09-30T19:57:08.043",
        "metrics": {
          "cvssMetricV40": [
            {
              "cvssData": {
                "Automatable": "YES",
                "Recovery": "NOT_DEFINED",
                "Safety": "NOT_DEFINED",
                "attackComplexity": "LOW",
                "attackRequirements": "NONE",
                "attackVector": "NETWORK",
                "availabilityRequirement": "NOT_DEFINED",
                "baseScore": 9.4,
                "baseSeverity": "CRITICAL",
                "confidentialityRequirement": "NOT_DEFINED",
                "exploitMaturity": "ATTACKED",
                "integrityRequirement": "NOT_DEFINED",
                "modifiedAttackComplexity": "NOT_DEFINED",
                "modifiedAttackRequirements": "NOT_DEFINED",
                "modifiedAttackVector": "NOT_DEFINED",
                "modifiedPrivilegesRequired": "NOT_DEFINED",
                "modifiedSubAvailabilityImpact": "NOT_DEFINED",
                "modifiedSubConfidentialityImpact": "NOT_DEFINED",
                "modifiedSubIntegrityImpact": "NOT_DEFINED",
                "modifiedUserInteraction": "NOT_DEFINED",
                "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
                "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
                "modifiedVulnIntegrityImpact": "NOT_DEFINED",
                "privilegesRequired": "NONE",
                "providerUrgency": "NOT_DEFINED",
                "subAvailabilityImpact": "HIGH",
                "subConfidentialityImpact": "HIGH",
                "subIntegrityImpact": "HIGH",
                "userInteraction": "PASSIVE",
                "valueDensity": "CONCENTRATED",
                "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:A/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:X/V:C/RE:X/U:X",
                "version": "4.0",
                "vulnAvailabilityImpact": "HIGH",
                "vulnConfidentialityImpact": "HIGH",
                "vulnIntegrityImpact": "HIGH",
                "vulnerabilityResponseEffort": "NOT_DEFINED"
              },
              "source": "csirt@divd.nl",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-09-30T17:16:40.550",
        "references": [
          {
            "source": "csirt@divd.nl",
            "url": "https://csirt.divd.nl/CVE-2026-102489"
          },
          {
            "source": "csirt@divd.nl",
            "url": "https://csirt.divd.nl/DIVD-2026-00015"
          }
        ],
        "sourceIdentifier": "csirt@divd.nl",
        "vulnStatus": "Deferred"
      }
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.