CVE-2026-102489: Zammad GmbH Zammad Session Fixation Vulnerability

According to Security Affairs, CVE-2026-102489 is a session hijacking vulnerability in Zammad that can lead to remote code execution as the zammad user[1]. The outlet adds that an attacker can first gain code execution as the zammad user through CVE-2026-102489 and then use CVE-2026-102490 to escalate to root.[1]WindowsForum reports that DIVD's CVE page rates CVE-2026-102489 at 8.7 (High) alone and 9.4 (Critical) when chained with CVE-2026-102490.[2]Secureblink reports that DIVD confirmed on October 1 that it was breached through its own ticketing platform on September 21[3]. According to Secureblink, the exposed data included DIVD volunteer email addresses and contact details, and the contents of CSIRT ticketing conversations[3].According to runZero, the flaw directly affects versions 6.3.0 through 6.5.4[4], while versions 7.0.0 through 7.1.3 contain the underlying code flaw but are not exploitable in practice[4].WindowsForum reports that Zammad partly disputes DIVD's findings[2] and that the company has not received technical details for CVE-2026-102490.[2]runZero says that Zammad version 7.2.0 includes security hardening to resolve this vulnerability.[4] Security Affairs reports that CISA orders federal agencies to fix the flaws by October 5, 2026.[1]