Session hijack chained to remote code execution in Zammad ticketing (CVE-2026-102489)
BleepingComputer reports that DIVD attributes a breach of its own network to a chain of two Zammad zero-days including this one, and VulnCheck added it to its KEV catalog on 2026-09-30; teams running an affected 6.x Zammad have an internet-facing helpdesk that attackers have already used to get code execution.
A session hijack flaw in Zammad 6.3.0 and later below 6.5.4 can be chained with a second flaw (CVE-2026-102490) to run code as the zammad user on the server; Zammad 7.0.0–7.1.3 contain the flaw but are reported not exploitable due to environment conditions.
Affected: Zammad >= 6.3.0 < 6.5.4 (CVE record text describes 6.3.0 to 6.5.4 as vulnerable); Zammad 7.0.0–7.1.3 (flaw present, reported not exploitable due to environment conditions)
How to Test
Check the running Zammad version in the admin interface or from the installed package on the host; any 6.3.0 or later deployment below 6.5.4 is in scope and 7.0.0–7.1.3 carries the flaw even if reported non-exploitable. Look for unexpected or hijacked agent/admin sessions, unfamiliar logins, and processes, cron entries or files created by the zammad OS user, and review DIVD's case page DIVD-2026-00015 for the indicators from the breach.
How to Patch
Upgrade Zammad to a release outside the affected range — the CVE record bounds the vulnerable 6.x line below 6.5.4 and reports 7.x as not exploitable, so move to the current Zammad release line. No vendor mitigation is given; if the upgrade must wait, restrict network access to the Zammad web interface to trusted sources.