GmbH Zammad Session Fixation Vulnerability
Exploited in the wild. CISA added it to its Known Exploited Vulnerabilities list on 2 Oct 2026.
22%
Reading the vendor advisory
Fix it in your code
Each opens with a short prompt that points at Global Hack Map's public runbook for CVE-2026-102489. Nothing runs until you send it.
Zammad versions 6.3.0 to 6.5.4 are vulnerable a session hijack vulnerability that leads to remote code execution as the zammad user. The bug is also present in version 7.0.0 to version 7.1.2, but not exploitable due to changes in the underlying framework.
You are affected if
The fix