Undisclosed RCE in Zammad v6.3 and higher
Affects Zammad 6.5 and earlier versions because of the runtime environment those versions use. The fix is included in Zammad 7.2.0. Zammad has not published a vendor severity rating.
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Listed in CISA KEV
- How many real-world setups can hit the bug, from the vendor's advisory and CISA data. It does not know your setup.What do these mean? →
- Actively exploited
- Fix
- Fixed in 6.5.4
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
- Exploitation: active
- Automatable: no
- Technical impact: total
Summary
Zammad, an open-source help desk and ticketing application, is affected by a flaw that allows an attacker to hijack a user's session and then execute code on the server with the privileges of the Zammad service account. Some later releases contain the same bug but are not exploitable because of changes in the underlying framework.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
Zammad versions 6.3.0 to 6.5.4 are vulnerable a session hijack vulnerability that leads to remote code execution as the zammad user. The bug is also present in version 7.0.0 to version 7.1.2, but not exploitable due to changes in the underlying framework.
Timeline
- CVE published
- CISA SSVC assessment
Exploitation: active · Automatable: no · Technical impact: total
- Added to CISA KEV
CISA has evidence of exploitation in the wild
- CISA remediation deadline
Due date for US federal agencies to patch
- Record last updated
- EPSS reached 10%
FIRST estimates at least a 10% chance of exploitation in the next 30 days
Affected versions
- Zammad GmbH Zammad
From 6.3.0 · fixed in 6.5.4
References 4
Questions about CVE-2026-102489
What does this mean?
The title describes this as an undisclosed remote code execution (RCE) flaw in Zammad. The checked facts do not describe the technical details of the bug.Source: zammad.com
Am I affected, and how do I check?
The product range lists Zammad 6.3.0 up to 6.5.4, while the advisory condition says Zammad 6.5 and earlier versions are affected due to their runtime environment. Compare your installed Zammad version against both statements.Source: zammad.com
What should I do about it?
Upgrade to Zammad 7.2.0, which the advisory says includes the fix.Source: zammad.com
Is it being exploited?
Yes. CISA added it to its Known Exploited Vulnerabilities catalog on 2026-10-02, which means it has evidence of attacks. No public exploit code is tracked.Source: cisa.gov, cve.now feed data