Zammad Session Hijack to Remote Code Execution (RCE) Vulnerability Advisory (CVE-2026-102489)
Executive & SecOps Summary
SECOPS ASSESSMENTZammad versions 6.3.0 to 6.5.4 (7.0.0 to 7.1.2 are vulnerable but currently non-exploitable)
Unauthenticated attackers can hijack user sessions and execute arbitrary code with 'zammad' user privileges.
Immediately update to the latest patched versions (6.5.5+ or 7.1.3+).
Affected Products & Version Scope
Remediation & Live Workaround Commands
PATCH & WORKAROUND- Update Zammad: Upgrade your installation to the latest stable release immediately.
# For Debian/Ubuntu
sudo apt-get update && sudo apt-get install --only-upgrade zammad
# For RHEL/CentOS
sudo yum update zammad- Invalidate Active Sessions: After patching, it is critical to clear all active sessions to mitigate any ongoing hijacking attempts that may have occurred prior to the patch.
- Monitoring: Implement WAF rules to detect anomalous session cookie behavior, such as rapid IP changes for a single session ID or unusual administrative requests.
Block Exploits Instantly with Managed Virtual Patching Rules
Can't patch production immediately? Deploy managed WAF rules at the edge to intercept RCE, SQLi, and deserialization payloads before they hit your origin server.
Technical Root Cause & Exploitation Mechanics
This vulnerability is rooted in a session fixation/hijacking flaw (CWE-384) within Zammad's session handling mechanism. An attacker can gain unauthorized access by obtaining or predicting valid session tokens. In the 6.x branch (specifically 6.3.0 - 6.5.4), this unauthorized access can be leveraged to interact with the underlying Ruby environment, leading to full Remote Code Execution (RCE) under the context of the 'zammad' user. With an EPSS score of 0.94 and inclusion in the CISA KEV catalog, this vulnerability is being actively exploited in the wild.
Official Vendor Advisories & References
Zammad versions 6.3.0 to 6.5.4 are vulnerable a session hijack vulnerability that leads to remote code execution as the zammad user. The bug is also present in version 7.0.0 to version 7.1.2, but not exploitable due to changes in the underlying framework.
Subscribe to Daily Vulnerability Briefings & KEV Alerts
Concise morning briefings for SecOps, DevSecOps, and SRE teams covering newly exploited CVEs and mitigation priorities.