CVE-2026-102489: Zammad GmbH Zammad Session Fixation Vulnerability

According to CISA's October 2 alert, it added CVE-2026-102489 Zammad GmbH Zammad Session Fixation Vulnerability[2] to its Known Exploited Vulnerabilities catalog. Cybersecurity News reports that CISA set an October 5, 2026 remediation deadline for federal civilian agencies.[3]Rescana reports that CISA describes the flaw as one "that can lead to remote code execution as the zammad user," which "can be chained with CVE-2026-102490."[4] Security Affairs says that second bug allows the zammad user to gain root privileges.[1]Rescana reports that NVD scores each at CVSS 3.1 9.8 Critical.[4] WindowsForum reports that DIVD rates CVE-2026-102489 at 8.7 (High) alone and 9.4 (Critical) when chained with CVE-2026-102490.[5]According to WindowsForum, DIVD lists Zammad 6.3.0 through 6.5.4 as affected.[5] The same outlet reports that DIVD says 7.0.0 through 7.1.3 also contain the flaw but aren't exploitable because of environment conditions.[5]Cybersecurity News reports that Zammad said CVE-2026-102489 is exploitable only on Zammad 6.5 and earlier, which are no longer supported.[3] The vendor also said, per that report, that Zammad 7.2.0 included additional code hardening.[3]Rescana reports that Zammad GmbH has publicly disagreed with DIVD on affected versions, on exploitability of CVE-2026-102490 on its own, and on how the disclosure was handled.[4]According to Security Affairs, the chained flaws let attackers hijack sessions, run code remotely and move from a regular Zammad account to root access within seconds.[1]