Zammad 6.3.0-6.5.4 - Session Hijacking & Remote Code Execution

Exploited in the wild. Listed by CISA on 2026-10-02; known to be used by ransomware.

criticalseverity

9.8CVSS score

49.9%likelihood of exploitation, next 30 days

99%of all CVEs are less likely

Readycheck to confirm it

Zammad 6.3.0 to 6.5.4 contains a session hijack vulnerability caused by improper session management, letting remote attackers execute code as the zammad user, exploit requires vulnerable version and session hijack.

Impact

Remote attackers can execute code as the zammad user, potentially compromising the system.

Fix

Update to a version later than 6.5.4 or 7.1.3 where the vulnerability is not exploitable.

How to confirm it

Send: websocket probe to the service port
Positive when: contains_all(response, "undefined method", "Sessions::Event::Base") and contains(response, "@clients")

Run it with nuclei: nuclei -id CVE-2026-102489 -u <target>

The full check

id: CVE-2026-102489

info:
  name: Zammad 6.3.0-6.5.4 - Session Hijacking & Remote Code Execution
  author: Abdullah Shahid (comradezephyr)
  severity: critical
  description: |
    Zammad 6.3.0 to 6.5.4 contains a session hijack vulnerability caused by improper session management, letting remote attackers execute code as the zammad user, exploit requires vulnerable version and session hijack.
  impact: |
    Remote attackers can execute code as the zammad user, potentially compromising the system.
  remediation: |
    Update to a version later than 6.5.4 or 7.1.3 where the vulnerability is not exploitable.
  reference:
    - https://zammad.com/en/advisories/cve-2026-102489-cve-2026-102490
    - https://csirt.divd.nl/CVE-2026-102489
    - https://horizon3.ai/attack-research/disclosures/cve-2026-102489-zammad-session-leak-rce/
    - https://github.com/horizon3ai/CVE-2026-102489
    - https://nvd.nist.gov/vuln/detail/CVE-2026-102489
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2026-102489
    epss-score: 0.49915
    epss-percentile: 0.98909
    cwe-id: CWE-384
  metadata:
    verified: true
    max-request: 1
    vendor: zammad
    product: zammad
    shodan-query: http.title:"zammad helpdesk"
    fofa-query: title="Zammad"
  tags: cve,cve2026,zammad,websocket,session,rce,kev,vkev

websocket:
  - address: "{{Scheme}}://{{Hostname}}/ws"

    inputs:
      - data: '{"event":"base"}'

    matchers:
      - type: dsl
        dsl:
          - 'contains_all(response, "undefined method", "Sessions::Event::Base")'
          - 'contains(response, "@clients")'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from