CVE-2026-102489 | defend.network

What is CVE-2026-102489?

Zammad versions 6.3.0 to 6.5.4 are vulnerable a session hijack vulnerability that leads to remote code execution as the zammad user. The vulnerability is also present in version 7.0.0 to version 7.1.3, but not exploitable due to environment conditions.

CVSS9.4 NVD 4.0

SeverityCRITICAL

ExploitationNo exploitation reported

Triage statusNo Known Exploit

ActionPatch within 48 hours

CVSS vectorCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:A/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:X/V:C/RE:X/U:X

NVD published2026-09-30

NVD last modified2026-09-30

Timeline

2026-09-30Published to the U.S. National Vulnerability Database (NVD)
2026-10-01First covered in a defend.network daily briefing

Affected product

See advisory

References

Referenced in our briefings & reports

Cisco SD-WAN, Zimbra, Zammad under attack; active exploitation confirmed (2026-10-01)

Browse all tracked CVEs in the defend.network CVE database →

🤖 This CVE page is generated by defend.network from NVD, CISA KEV, EPSS, and our verified daily briefings. Severity and exploitation data come from official sources; always verify remediation steps against the official vendor advisory before acting in production.

What is CVE-2026-102489?

Timeline

Affected product

References

Referenced in our briefings & reports

Get Critical CVE Alerts