CVE-2026-102489: Zammad GmbH Zammad Session Fixation Vulnerability

SecurityOnline reports that attackers chained two Zammad zero-day flaws to break into the Dutch Institute for Vulnerability Disclosure (DIVD) on September 21.[2] The outlet adds that DIVD says the attack looked like the work of an agentic AI[2].According to the CVE record on ThreatInt, Zammad versions 6.3.0 to 6.5.4 are vulnerable a session hijack vulnerability that leads to remote code execution as the zammad user.[3] The record also says the flaw is in version 7.0.0 to version 7.1.3, but not exploitable due to environment conditions.[3]Infosecurity Magazine reports that both flaws have a CVSS score of 9.4 when chained.[4] SecurityOnline says the session hijack flaw on its own carries a CVSS 4.0 score of 8.7.[2]BleepingComputer says that DIVD discovered the zero-day vulnerabilities in collaboration with Merlon Security.[1] The nonprofit recommends that Zammad users upgrade to version 7, which is considered safe, or take the instance offline as soon as possible.[1]The HOL Blog reports that CISA added CVE-2026-102489 and CVE-2026-102490 to the Known Exploited Vulnerabilities catalog today (2026-10-02).[5] The blog also says that Zammad states it hardened the code in 7.2.0.[5]