CVE Vulnerability Advisory Database
Filter vulnerabilities by CVSS severity, active CISA KEV exploitation, and technology stack.
Showing 1โ1 of 1 advisories (Page 1/1)
2026-09-30
Zammad Session Hijack to Remote Code Execution (RCE) Vulnerability Advisory (CVE-2026-102489)
[Affected Scope] Zammad versions 6.3.0 to 6.5.4 (7.0.0 to 7.1.2 are vulnerable but currently non-exploitable)
[Impact] Unauthenticated attackers can hijack user sessions and execute arbitrary code with 'zammad' user privileges.
[Mitigation] Immediately update to the latest patched versions (6.5.5+ or 7.1.3+).