CVE-2026-102489: Zammad GmbH Zammad Session Fixation Vulnerability

According to WindowsForum, CISA labels the first a Session Fixation Vulnerability and the second an Improper Privilege Management Vulnerability. The agency says it added them based on evidence of active exploitation.[2] HOL Blog reports that the KEV due date is 2026-10-05.[3]GBHackers reports that the flaws "were reportedly used in an intrusion against DIVD on September 21, 2026."[4] SecurityOnline reports that DIVD says the attack looked like the work of an agentic AI[5].According to GBHackers, CVE-2026-102489 affects Zammad versions 6.3.0 through 6.5.4.[4] The outlet reports that DIVD says the same vulnerable code exists in versions 7.0.0 through 7.1.3 but "is not exploitable in those versions due to specific environmental conditions."[4]SecurityOnline reports that the CVE record lists a CVSS 4.0 score of 8.7[5], and that both CVE records rate the chained attack 9.4, which is Critical.[5]WindowsForum reports that Zammad's October 1 community statement "partly disputes DIVD's findings,"[2] and that the vendor recommends updating to 7.2.0, and updating immediately if you run 6.5 or older.[2]GBHackers reports that DIVD recommends that all Zammad users upgrade to version 7 or take affected instances offline.[4] According to the outlet, DIVD has also published an IoC log-check script for CVE-2026-102489 and is actively scanning for vulnerable public instances[4].