🔴

CISA Known Exploited Vulnerability

This CVE is actively exploited in the wild. CISA mandates federal agencies to patch immediately.

CVE

CVE-2026-102489

9.4

CVSShigh

Exploitable remotely over the internet · no authentication required.

Description

Zammad versions 6.3.0 to 6.5.4 are vulnerable a session hijack vulnerability that leads to remote code execution as the zammad user. The bug is also present in version 7.0.0 to version 7.1.2, but not exploitable due to changes in the underlying framework.

Attack Vector

Network

Privileges Req.

None

User Interaction

zammad

Updated Nov 6, 2026View on NVD →

S4E scanner

criticalProduct Based Web Vulnerabilities~10 seconds

CVE-2026-102489 Scanner

Detects ‘Session Hijacking’ vulnerability in Zammad affecting versions 6.3.0–6.5.4. Checks WebSocket error responses for indicators of session information exposure.

Used 3 times · 4.2k assets checked · domain, subdomain, ipv4

Scanner page →Run scanner

CVE history: zammad

Predict next CVE date with AI

Monitor this CVE on your assets

S4E maps published CVEs to scanners and forecasts the next disclosure window for your stack.

Create a free account →