CVE-2026-102489: Zammad GmbH Zammad Session Fixation Vulnerability

GBHackers reports that CVE-2026-102489 is a session fixation vulnerability (CWE-384) that can allow remote code execution under the local Zammad account.[1] The outlet says CISA stated that this issue can be combined with CVE-2026-102490[1], a privilege flaw that lets attackers go from the Zammad user to root.According to GBHackers, both entries were added to the KEV Catalog on October 2, 2026, with a remediation deadline set for October 5, 2026.[1]Rescana reports that DIVD describes the intrusion as an agentic-AI-driven attack and says the two flaws were chained against it.[2] Rescana also says DIVD reported that attackers exfiltrated volunteer data, including DIVD email addresses and possibly contact details[2].GBHackers reports that the first flaw affects Zammad versions 6.3.0 through 6.5.4, as noted in the CVE record published by the Dutch Institute for Vulnerability Disclosure[1]. Rescana says that NVD scores each at CVSS 3.1 9.8 Critical.[2]According to Cyber Security News, Zammad said CVE-2026-102489 is exploitable only on Zammad 6.5 and earlier, which are no longer supported.[3] The outlet reports that the company said versions 7.0 and later are not affected in practice, and that Zammad 7.2.0 included additional code hardening.[3]Cyber Security News also reports that Zammad confirmed that the privilege-escalation issue cannot be exploited remotely on its own.[3] According to the same outlet, administrators should update to Zammad 7.2.0, especially if they operate version 6.5 or older.[3]