CVE-2026-102489: Zammad GmbH Zammad Session Fixation Vulnerability

Security Affairs reports that CVE-2026-102489 is a session hijacking vulnerability in Zammad that can lead to remote code execution as the zammad user[1]. It adds that an attacker can then use CVE-2026-102490 to escalate to root.[1]Secureblink reports that DIVD confirmed on October 1 that it was breached through its own ticketing platform on September 21[2].Windowsforum reports that DIVD lists Zammad 6.3.0 through 6.5.4 as affected[3]. DIVD rates the flaw at 8.7 (High) alone and 9.4 (Critical) when chained with CVE-2026-102490.[3] Xhack.io, however, says "NVD scores it 9.8."[4]According to Windowsforum, Zammad says the flaw is exploitable only on Zammad 6.5 and older[3]. Zammad also has not received technical details for CVE-2026-102490.[3]Security Affairs reports that CISA orders federal agencies to fix the flaws by October 5, 2026.[1] Byteiota reports that CISA's listing includes a forensic-triage flag[5].RunZero says version 7.2.0 includes security hardening to resolve this vulnerability[6]. It adds that Zammad has not released an official patch[6] for CVE-2026-102490.InfoSec Today reports that DIVD is actively notifying owners of vulnerable instances and has published a script to check logs for signs of abuse.[7]