CVE-2026-102489: Zammad GmbH Zammad Session Fixation Vulnerability

GBHackers says CVE-2026-102489 is a session fixation vulnerability (CWE-384) that can allow remote code execution under the local Zammad account[1]. It adds that CISA said the flaw can be chained with CVE-2026-102490 to escalate privileges from the Zammad user to root[1].According to GBHackers, both entries were added to the KEV Catalog on October 2, 2026, with a remediation deadline set for October 5, 2026.[1]Rescana reports that DIVD assigned both CVEs after DIVD says attackers first accessed its own systems on 21 September 2026 by abusing Zammad vulnerabilities[2]. Rescana also says DIVD describes the intrusion as an agentic-AI-driven attack[2].Rescana says DIVD reported that the attackers exfiltrated volunteer data, including DIVD email addresses and possibly contact details, and that network segmentation stopped them going deeper[2].Cybersecurity News reports that Zammad said CVE-2026-102489 is exploitable only on Zammad 6.5 and earlier, which are no longer supported[3]. It adds that Zammad said versions 7.0 and later are not affected in practice, and that Zammad 7.2.0 included additional code hardening[3].Rescana notes that Zammad GmbH has publicly disagreed with DIVD on affected versions[2] and on how the disclosure was handled.RunZero writes that users are encouraged to update to the latest version as quickly as possible[4], which means Zammad 7.2.0 or later.