Undisclosed RCE in Zammad v6.3 and higher (CVE-2026-102489)

What is affected, what to do

Zammad versions 6.3.0 to 6.5.4 are vulnerable a session hijack vulnerability that leads to remote code execution as the zammad user. The bug is also present in version 7.0.0 to version 7.1.2, but not exploitable due to changes in the underlying framework.

The vulnerability is being actively exploited; treat it as a priority. Update Zammad to version 6.5.4. Immediate actions, mitigation and detection rules are in the runbook below.

Affected

• Zammad lt 6.3.0..6.5.4

Fixed in

• Zammad 6.5.4

Not sure whether and how you are affected? Ask a question about this vulnerability

Metrics

Response and mitigation

1. 01

   Runbook step 1

   Immediate response (0-24 h)

   • Inventory every exposed Zammad instance and check its version. Versions 6.3.0 through 6.5.4 are affected. The bug is also present in 7.0.0 through 7.1.2, but the vendor states it is not exploitable there due to framework changes. Check the version via Admin → System → Info or with dpkg -l zammad / rpm -q zammad.
   • Upgrade to Zammad 7.2. The context lists this version as patched. For the 6.x branch, the context contradicts itself by listing 6.5.4 as both affected and fixed. Look up the fixed 6.x version in the vendor advisory and treat 6.5.4 as vulnerable until that is confirmed.
   • Cut internet exposure now if you cannot patch immediately. Restrict the reverse proxy (nginx/Apache in front of Puma on 127.0.0.1:3000 and the WebSocket on 6042) to VPN, corporate ranges or an IP allowlist. Put customer portals into maintenance mode if necessary.
   • Invalidate all existing sessions. Session fixation means pre-planted or hijacked sessions remain valid after patching. Purge active sessions, for example via zammad run rails c and the session table; confirm the exact procedure in vendor documentation. Consider rotating secret_key_base as well.
   • Rotate credentials: passwords and API tokens for admin and agent accounts, email channel credentials (IMAP/SMTP/Microsoft 365/Google OAuth), and integration secrets (LDAP bind, webhooks, Elasticsearch, telephony). Code execution as zammad means /opt/zammad/config and the database credentials should be considered exposed.
   • Assess and patch CVE-2026-102490 in parallel. Chaining the two vulnerabilities is the likely attack path.
2. 02

   Runbook step 2

   Mitigation layers

   • Network segmentation: Place the Zammad application server in a DMZ or application zone. Allow egress only to required destinations (mail server, Elasticsearch, PostgreSQL, package repository). Block generic outbound HTTP/HTTPS and external DNS to hamper reverse shells and payload staging.
   • WAF/reverse proxy: Reject session cookies (_zammad_session_*) supplied via query strings or URL parameters, and block requests that carry session IDs in GET parameters. Rate-limit /api/v1/signin, /api/v1/signshow and /api/v1/sessions. Enforce Secure, HttpOnly and SameSite=Strict cookie attributes at the proxy if they are missing.
   • Endpoint hardening: Run the zammad service account with no login shell and no sudo rights. Remove runtime write access to /opt/zammad/app and /opt/zammad/config where the packaging allows it. Optionally use AppArmor/SELinux to stop Puma/Ruby from spawning sh, bash, curl, wget, nc or python.
   • IAM/least privilege: Reduce admin roles to the minimum. Enforce 2FA for all agents and admins. Restrict the admin interface to management networks via a proxy rule.
   • Configuration: Temporarily disable unneeded authentication paths (third-party login, customer self-registration) to shrink the session-handling attack surface.
3. 03

   Runbook step 3

   Detection rules

   • Process ancestry (EDR, Sysmon for Linux EID 1, auditd execve): a shell or network tool spawned by Ruby/Puma under uid=zammad. Sigma shape: ParentImage|endswith: ['/ruby','/puma'] AND Image|endswith: ['/sh','/bash','/curl','/wget','/nc','/python3'] AND User: zammad. auditd rule: -a always,exit -F arch=b64 -S execve -F uid=$(id -u zammad) -k zammad_exec.
   • Web server access logs: the same session ID appearing from different source IPs or user agents within a short window, plus session parameters in URLs. SPL sketch: index=web sourcetype=nginx host=zammad* | rex "_zammad_session_\w+=(?<sid>[^;]+)" | stats dc(clientip) as ips values(clientip) by sid | where ips>1.
   • Zammad application data: unexpected new admin accounts, role changes, new API tokens, altered triggers, macros or webhooks, and modified email channels since 6.3.0 was deployed. Review Admin → Monitoring, the history table and /opt/zammad/log/production.log.
   • Network telemetry (Zeek/Suricata): outbound connections from the Zammad host to unfamiliar destinations, especially long-lived TCP sessions on unusual ports or HTTP downloads of ELF binaries and scripts (conn.log, and http.log with mime_type application/x-executable or text/x-shellscript).
   • File integrity (auditd/FIM): new or modified files owned by zammad under /opt/zammad, /tmp and /var/tmp, plus crontab entries or ~/.ssh/authorized_keys for the zammad user.

Detection rules

No NEOSEC detection rule is available for this vulnerability yet.

Classification under NIS2 and CRA

Rule-based classification from exploitation status and severity. It does not replace a case-by-case assessment.

NIS2

NIS2 is EU Directive (EU) 2022/2555 to raise the level of cybersecurity across the Union. It substantially broadens obligations compared with the first NIS directive: more sectors, mandatory risk management, staged reporting duties and personal accountability of senior management.

Read in glossary

Actively exploited: treat the vulnerability as a priority in vulnerability handling under Art. 21(2)(e) NIS2. If it is exploited in your environment, check the reporting obligation under Art. 23 (early warning within 24 hours).

CRA

The CRA is EU Regulation (EU) 2024/2847 setting horizontal cybersecurity requirements for „products with digital elements“ — from industrial controllers and software to connected consumer devices. For the first time manufacturers must ensure security across the entire product lifecycle, handle vulnerabilities and provide security updates.

Read in glossary

Since 11.09.2026, manufacturers of affected products with digital elements must report actively exploited vulnerabilities under Art. 14 CRA, with an early warning within 24 hours via ENISA's single reporting platform.

ISO/IEC 27001

ISO/IEC 27001 is the internationally leading standard for an information security management system (ISMS). It describes a risk-based, process-oriented framework to systematically plan, implement, review and improve information security.

Read in glossary

Control A.8.8, management of technical vulnerabilities: assess relevance to your systems, plan remediation and keep evidence.

Description

Zammad versions 6.3.0 to 6.5.4 are vulnerable a session hijack vulnerability that leads to remote code execution as the zammad user. The bug is also present in version 7.0.0 to version 7.1.2, but not exploitable due to changes in the underlying framework.

Source: pwn.watch, cvelistv5, NVD (NIST), CISA KEV Catalog, BSI WID Portal, BSI CSAF

Vendors and products

• Zammad Zammad
• Zammad Gmbh Zammad

Weakness classes (CWE)

• CWE-384Session Fixation

  Compound

  Authenticating a user, or otherwise establishing a new user session, without invalidating any existing session identifier gives an attacker the opportunity to steal authenticated sessions.

  Entry at MITRE CWE-384

References & sources

• csirt.divd.nlDIVD-2026-00015Third-party advisory
• csirt.divd.nlCVE-2026-102489Third-party advisory
• cisa.govknown-exploited-vulnerabilities-catalog?field_cve=CVE-2026-1024…government-resource
• zammad.comen/advisories/cve-2026-102489-cve-2026-102490Vendor advisory
• community.zammad.orgt/take-care-local-privilege-escalation-cve-2026-102490-is-repor…Technical description
• pwn.watchpwn.watch: Zammad GmbH Zammad: Zammad GmbH Zammad Improper Privilege Management Vulnerabilitypwn-watch
• zammad.comZammad GmbH Zammad — CVE-2026-102490pwn-watch
• NVD (NIST)NVD: CVE-2026-102490pwn-watch
• NVD (NIST)NVD: CVE-2026-102489pwn-watch
• cisa.govCISA Known Exploited Vulnerabilities Catalogpwn-watch

Changes to this CVE

Who changed this CVE and when: NVD (analysis, affected products, CVSS), the CVE publisher (CNA) and additional providers such as CISA (ADP).

1. 10.10.2026Record modifiedCISA ADP

   CISA assessment (SSVC): exploitation: active, automatable: no

   Show 2 original changes

   Individual changes of this event as published by NVD

   Type	Action	Before	After
   SSVC assessment	removed	{"id":"CVE-2026-102489","role":"CISA Coordinator","options":[{"exploitation":"active"},{"automatable":"no"},{"technicalImpact":"total"}],"version":"2.0.3","timestamp":"2026-10-09T15:59:10.993019Z"}	—
   SSVC assessment	added	—	{"id":"CVE-2026-102489","role":"CISA Coordinator","options":[{"exploitation":"active"},{"automatable":"no"},{"technicalImpact":"total"}],"version":"2.0.3","timestamp":"2026-10-02T00:00:00+00:00"}

   Source identifier: 134c704f-9b21-4f2e-91b3-4a467353bcc0

2. 09.10.2026Record modifiedCISA ADP

   CISA assessment (SSVC): exploitation: active, automatable: no

   Show 2 original changes

   Individual changes of this event as published by NVD

   Type	Action	Before	After
   SSVC assessment	removed	{"id":"CVE-2026-102489","role":"CISA Coordinator","options":[{"exploitation":"active"},{"automatable":"yes"},{"technicalImpact":"total"}],"version":"2.0.3","timestamp":"2026-10-02T00:00:00+00:00"}	—
   SSVC assessment	added	—	{"id":"CVE-2026-102489","role":"CISA Coordinator","options":[{"exploitation":"active"},{"automatable":"no"},{"technicalImpact":"total"}],"version":"2.0.3","timestamp":"2026-10-09T15:59:10.993019Z"}

   Source identifier: 134c704f-9b21-4f2e-91b3-4a467353bcc0

3. 07.10.2026NVD analysis modifiedNVD

   Product mapping changed:

   • Zammad (6.3.0 – through 6.5.4)

   New references:

   • https://community.zammad.org/t/take-care-local-privilege-escalation-cve-2026-102490-is-reported-as-being-actively-exploited/21297/2
   • https://zammad.com/en/advisories/cve-2026-102489-cve-2026-102490
   Show 3 original changes

   Individual changes of this event as published by NVD

   Type	Action	Before	After
   Product configuration	changed	AND OR *cpe:2.3:a:zammad:zammad:*:*:*:*:*:*:*:* versions from (including) 6.3.0 up to (excluding) 6.5.4 *cpe:2.3:a:zammad:zammad:*:*:*:*:*:*:*:* versions from (including) 7.0.0 up to (including) 7.1.3 OR cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:* cpe:2.3:a:docker:docker:-:*:*:*:*:*:*:*	AND OR *cpe:2.3:a:zammad:zammad:*:*:*:*:*:*:*:* versions from (including) 6.3.0 up to (including) 6.5.4 OR cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:* cpe:2.3:a:docker:docker:-:*:*:*:*:*:*:*
   Reference type	added	—	Dutch Institute for Vulnerability Disclosure: https://community.zammad.org/t/take-care-local-privilege-escalation-cve-2026-102490-is-reported-as-being-actively-exploited/21297/2 Types: Vendor Advisory
   Reference type	added	—	Dutch Institute for Vulnerability Disclosure: https://zammad.com/en/advisories/cve-2026-102489-cve-2026-102490 Types: Vendor Advisory

   Source identifier: nvd@nist.gov

4. 07.10.2026Record modifieddivd.nl

   Description added or changed

   New references:

   • https://community.zammad.org/t/take-care-local-privilege-escalation-cve-2026-102490-is-reported-as-being-actively-exploited/21297/2
   • https://zammad.com/en/advisories/cve-2026-102489-cve-2026-102490
   Show 5 original changes

   Individual changes of this event as published by NVD

   Type	Action	Before	After
   Tag	added	—	unsupported-when-assigned
   Description	changed	Zammad versions 6.3.0 to 6.5.4 are vulnerable a session hijack vulnerability that leads to remote code execution as the zammad user. The vulnerability is also present in version 7.0.0 to version 7.1.3, but not exploitable due to environment conditions.	Zammad versions 6.3.0 to 6.5.4 are vulnerable a session hijack vulnerability that leads to remote code execution as the zammad user. The bug is also present in version 7.0.0 to version 7.1.2, but not exploitable due to changes in the underlying framework.
   Affected versions (publisher)	added	—	Affected value modified. <a href="https://github.com/CVEProject/cvelistV5/blob/main/cves/2026/102xxx/CVE-2026-102489.json">CVE-2026-102489</a>
   Reference	added	—	https://community.zammad.org/t/take-care-local-privilege-escalation-cve-2026-102490-is-reported-as-being-actively-exploited/21297/2
   Reference	added	—	https://zammad.com/en/advisories/cve-2026-102489-cve-2026-102490

   Source identifier: csirt@divd.nl

5. 03.10.2026Record modifiedCISA ADP

   CISA assessment (SSVC): exploitation: active, automatable: yes

   Show 2 original changes

   Individual changes of this event as published by NVD

   Type	Action	Before	After
   SSVC assessment	removed	{"id":"CVE-2026-102489","role":"CISA Coordinator","options":[{"exploitation":"active"},{"automatable":"yes"},{"technicalImpact":"total"}],"version":"2.0.3","timestamp":"2026-10-02T16:27:26.039890Z"}	—
   SSVC assessment	added	—	{"id":"CVE-2026-102489","role":"CISA Coordinator","options":[{"exploitation":"active"},{"automatable":"yes"},{"technicalImpact":"total"}],"version":"2.0.3","timestamp":"2026-10-02T00:00:00+00:00"}

   Source identifier: 134c704f-9b21-4f2e-91b3-4a467353bcc0

Linked advisories

• NCSC-2026-0396 [1.00] [H/H] Kwetsbaarheden aangetroffen in ZammadNCSC-NL30.09.2026