CVE-2026-102489

Published on September 30, 2026

Zammad versions 6.3.0 to 6.5.4 are vulnerable a session hijack vulnerability that leads to remote code execution as the zammad user. The vulnerability is also present in version 7.0.0 to version 7.1.3, but not exploitable due to environment conditions.

Vulnerabilities

Two Zammad Zero-Days Let an AI-Driven Intruder Reach Root on DIVD Systems

DIVD says two Zammad zero-days enabled session hijacking, remote code execution and root escalation in an AI-driven breach. Upgrade to Zammad 7 now.

Oct 1, 202603:465 min readRead

This product uses the NVD API but is not endorsed or certified by the NVD.

CVE database

Related articles

Two Zammad Zero-Days Let an AI-Driven Intruder Reach Root on DIVD Systems