> ## Content Index > Fetch the complete content index at: https://f4n6.co.uk/llms.txt > Use this file to discover other available public pages before exploring further. # CVE-2026-102489 Zammad GmbH Zammad: Zammad GmbH Zammad Session Fixation Vulnerability - URL: https://f4n6.co.uk/security-feed/cve-2026-102489-zammad-gmbh-zammad-zammad-gmbh-zammad-session-fixation-vulnerability/ - Published: 2026-10-02T22:57:39.000Z - Updated: 2026-10-02T22:57:39.000Z - Author: Jeff Davies - Tags: #security-feed, CVE-2026-102489, CVE-2026-102490 ## 1\. Executive summary Zammad GmbH's Zammad helpdesk platform carries a session fixation flaw, CVE-2026-102489, rated CVSS 9.4 CRITICAL and listed in CISA KEV as of 2026-10-02\. Successful exploitation leads to remote code execution in the context of the zammad user, and the flaw can be chained with CVE-2026-102490 (CVSS 9.4 CRITICAL, also in KEV, CWE-269 improper privilege management) to extend the attacker's reach. CISA's required remediation due date is 2026-10-05, three days from issue. Any EMEA financial services firm running Zammad with internet-facing exposure should treat this as a P1 patch: the combination of a KEV listing, a three-day federal deadline, and RCE as the application service account leaves little room for a normal change window. ## 2\. Regulatory framing | Article | Trigger (the fact in this item) | Practical impact | | ------------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------- | | DORA Art. 17 | CVE-2026-102489 permits remote code execution as the zammad user, so an exploited instance is an ICT-related incident requiring a managed response process | The incident management process must cover detection, containment and eradication for this specific RCE path, not just availability loss | | DORA Art. 19 | CISA KEV listing with a 2026-10-05 remediation deadline establishes the flaw as actively exploited, which bears on whether an incident is major | If exploitation is confirmed, the major-incident reporting clock to the competent authority starts from classification, not from patch completion | | NIS2 Art. 21(2)(d) | Zammad is a third-party product in the supply chain, and the fix depends on vendor instructions | Supply chain security measures must include a verified path to obtain and apply the vendor fix, and a fallback if it is unavailable | No specific UK NIS 2018 duty is engaged on the facts available; the source does not identify the affected entity as an OES or RDSP. ## 3\. Technical analysis & attack chain The source material is thin. NVD describes CVE-2026-102489 as a session fixation vulnerability in Zammad GmbH Zammad that can lead to remote code execution as the zammad user, and states it can be chained with CVE-2026-102490\. No affected version range, no fixed version, no patch commit, and no exploitation telemetry are provided. The following chain is what the source supports; steps beyond that are marked as unconfirmed. 1. An attacker fixes a session identifier on a victim's browser or client, exploiting CVE-2026-102489 (CWE-384, session fixation). The source does not describe the delivery mechanism. 2. The victim authenticates, and the attacker's pre-set session becomes authenticated. 3. The attacker uses the authenticated session to reach a code execution path, achieving remote code execution as the zammad user. 4. The attacker chains CVE-2026-102490 (CWE-269, improper privilege management) to escalate or extend control. The source does not describe the escalation mechanism. What a defender can act on from this: the vulnerable component is the Zammad web application itself, and the post-exploitation context is the zammad service account. That account typically owns the application's database credentials and file store, so RCE as zammad is effectively access to all helpdesk ticket content, attachments, and any integrated mail or chat channels. The source does not state whether the zammad user is containerised or runs directly on the host, which determines whether RCE stays inside a container or reaches the underlying OS. CWE discrepancy: the verified reference data records CWE-384 (Session Fixation) for CVE-2026-102489, matching the source's description. No conflict to note on this CVE. Confidence caveat: the entire technical description rests on the NVD entry and the CISA KEV record. No vendor advisory, no proof-of-concept, and no incident reporting are present in the supplied material. The RCE claim is single-sourced to NVD and should be treated as accurate for prioritisation but unverified against a vendor bulletin until one is obtained. ## 4\. Mitigation & containment P1 (within 24 hours) - Identify every Zammad instance in the estate and determine internet exposure. CISA's required action explicitly places the burden on stakeholders to evaluate each asset's internet exposure. - Apply the vendor mitigation in accordance with vendor instructions. The source does not name a fixed version; obtain the vendor advisory before patching and do not assume a version number. - If no mitigation is available, CISA's guidance is to discontinue use of the product. For an internet-facing instance with no fix, take it offline rather than leave it exposed. - Rotate the zammad service account credentials and any database credentials the account can read, on the assumption that RCE as zammad exposes them. - Invalidate all active sessions on any instance that was internet-facing during the exposure window. Session fixation means existing sessions cannot be trusted. P2 (within 72 hours) - Review Zammad access logs for session identifiers issued before authentication and reused after, which is the signature of session fixation. The source gives no log format, so this is a manual review against the application's own logging. - Check for unexpected processes spawned by the zammad user, and for outbound connections from the Zammad host that do not match normal mail, chat or update traffic. - Confirm whether CVE-2026-102490 is patched on the same instance. The two are chainable, so patching one without the other leaves the chain partially open. P3 (within 7 days) - Add Zammad to the asset inventory with an owner and an exposure classification, so the next KEV entry against it does not require a discovery exercise. - Where Zammad is delivered as a managed or hosted service, confirm the provider's patch status in writing and check whether the contract covers this notification. ## 5\. Indicators of compromise No indicators of compromise available in the source material. The sources provide no hashes, domains, IP addresses, file paths, or command lines. Behavioural indicators | behaviour | where to observe | confidence | | ------------------------------------------------------------------------- | --------------------------------------------------- | ------------------------------------------------------------------- | | Session identifier set before authentication and reused after login | Zammad application and reverse-proxy access logs | Medium; inferred from CWE-384, not from a source-provided detection | | Process execution as the zammad user outside normal application behaviour | Host EDR or process accounting on the Zammad server | Medium; inferred from the RCE-as-zammad description | | Chained privilege escalation following a suspicious authenticated session | Zammad application logs plus host audit logs | Low; the source states the chain exists but describes no mechanism | ## 6\. Detection Insufficient indicators to author detection rules. The sources contain no distinctive strings, command-line flags, file names, registry keys, or other artefacts of the threat itself. The only named entities are the CVE identifiers and the product name, which are not threat artefacts. ## CVE assessment 2 referenced CVEs — **2 actively exploited (CISA KEV)**, 2 critical (CVSS ≥ 9.0) | CVE | CVSS | Exploited | EPSS | Summary | | ---------------------------------------------------------------------------------- | ------------ | ---------------- | ---- | ------------------------------------------------------------------------------------------------------------------------------- | | [CVE-2026-102489](https://nvd.nist.gov/vuln/detail/CVE-2026-102489?ref=f4n6.co.uk) | 9.4 Critical | ⚠ KEV 2026-10-02 | 1% | Zammad versions 6.3.0 to 6.5.4 are vulnerable a session hijack vulnerability that leads to remote code execution as the zammad… | | [CVE-2026-102490](https://nvd.nist.gov/vuln/detail/CVE-2026-102490?ref=f4n6.co.uk) | 9.4 Critical | ⚠ KEV 2026-10-02 | 0% | All versions of Zammad including the latest alpha enable the local zammad user to escalate privileges to root. | ## 7\. Sources - NVD, CVE-2026-102489 detail, https://nvd.nist.gov/vuln/detail/CVE-2026-102489, published 2026-10-01 - CISA Known Exploited Vulnerabilities catalog entry for CVE-2026-102489, added 2026-10-02, remediation due 2026-10-05 - The Hacker News, "CISA Adds Exploited N-able N-central Flaw to KEV After Customer Compromises", https://thehackernews.com/2026/08/cisa-adds-exploited-n-able-n-central.html (context only; concerns CVE-2026-18577 and CVE-2026-18556, unrelated to this item) ## 8\. Adverse Trace position Adverse Trace assesses CVE-2026-102489 as CVSS 9.4 CRITICAL, in CISA KEV since 2026-10-02, with a federal remediation deadline of 2026-10-05\. The RCE-as-zammad outcome and the chain with CVE-2026-102490 (CVSS 9.4 CRITICAL, KEV, CWE-269) put this above routine patch cadence for any client with an internet-facing Zammad instance. The technical detail is single-sourced to NVD and the KEV record; we have no vendor advisory, no affected version range, and no exploitation telemetry, so clients should verify the fixed version directly with Zammad before scheduling the change. We will obtain the vendor advisory and update this note with the affected and fixed versions, and we will re-issue if exploitation against EMEA financial services is reported. Clients running Zammad should confirm exposure to us today so we can prioritise the patch window against the 2026-10-05 deadline. --- [Read the original source →](https://nvd.nist.gov/vuln/detail/CVE-2026-102489?ref=f4n6.co.uk) *Published via PulseTrace — Adverse Trace threat intelligence.*