CVE-2026-102489 | Technical Details
Zammad flaw CVE-2026-102489 leaks WebSocket session cookies unauthenticated, enabling hijack and RCE, and is in CISA KEV.
CVE-2026-102489 is an unauthenticated session-disclosure flaw in the Zammad helpdesk, scored CVSS 9.8. A crafted WebSocket event triggers a Ruby error that exposes connected users’ session cookies, which can be replayed to hijack sessions. An administrator session can lead to remote code execution as the zammad user, and DIVD says attackers chained CVE-2026-102490 to reach root. CISA added it to the KEV catalog on October 2, 2026. Zammad recommends upgrading to 7.2.0 or later; versions 6.5 and earlier are unsupported.
- Unauthenticated WebSocket error leaks session cookies of connected users.
- Admin session hijack can yield code execution as the zammad user.
- Attackers chained CVE-2026-102490 to escalate privileges to root.
- Added to CISA KEV on October 2, 2026; CVSS 9.8.
- Upgrade to Zammad 7.2.0 or later; 6.5 and earlier are unsupported.
Vulnerabilities mentionedAll →
- CVE-2026-1024899.41%Session hijack to RCE in Zammadpublished · Zammad KEV PoC +1 related
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
Full article598 words · extracted from horizon3.ai · click to collapse
Zammad Unauthenticated WebSocket Session Disclosure Vulnerability
CVE-2026-102489 is an unauthenticated session disclosure vulnerability in Zammad, an open-source helpdesk and customer support ticketing platform. An attacker can obtain connected users’ session cookies and hijack their sessions. Hijacking an administrator session can lead to remote code execution as the zammad system user. The vulnerability has been exploited in the wild and was added to CISA’s Known Exploited Vulnerabilities catalog on October 2, 2026. Horizon3’s attack research team reverse engineered the vulnerability.
Technical Details
The vulnerability affects Zammad’s WebSocket event handling. An unauthenticated attacker can send a crafted event that triggers a Ruby error. The resulting error output exposes session cookies belonging to connected users.
An attacker can replay a disclosed cookie to hijack the corresponding session. If an administrator session is exposed, that access can lead to remote code execution with the permissions of the zammad system account. Successful exploitation can expose support tickets, customer records, and credentials accessible to the application.
CVE-2026-102489 provides code execution as the zammad user. Root access requires a separate privilege escalation step. DIVD reports that attackers chained this vulnerability with CVE-2026-102490 to escalate privileges to root.
CVE-2026-102489 has a CVSS 3.x score of 9.8 (Critical)
Stop Guessing, Start Proving
NodeZero® Proactive Security Platform – Rapid Response
A NodeZero Rapid Response test has been developed to safely validate whether this vulnerability can be exploited in your environment. The test executes real attack techniques without causing damage, giving teams immediate clarity on exposure.
- Run the Rapid Response test: Launch from the NodeZero platform to determine whether unauthenticated WebSocket session disclosure is possible.
- Patch immediately: Upgrade to Zammad 7.2.0 or a later supported release, following the vendor’s update instructions.
- Re-run the test: Confirm the vulnerability is no longer exploitable after remediation.
Indicators of Compromise
DIVD has published a log-check script for CVE-2026-102489 that searches application and web server logs for session material in error output. The script looks for error entries containing "Cookie"=>" or @clients={.
Matching entries warrant investigation for session disclosure and subsequent abuse. An absence of matches does not rule out compromise.
Affected versions & patch
Affected
DIVD’s narrative advisory identifies Zammad 6.3.0 through 6.5.4 as vulnerable. However, its structured CVE version data specifies 6.3.0 up to, but excluding, 6.5.4. Because these sources conflict, administrators should not treat 6.5.4 as a confirmed fixed release.
DIVD also reports that the vulnerable code exists in 7.0.0 through 7.1.3, but is not exploitable because of the runtime environment. Zammad states that 7.0 and later are not affected in practice.
Fixed
Upgrade to Zammad 7.2.0 or a later supported release. Zammad confirms that 7.2.0 includes hardening of the affected code and recommends this upgrade for administrators. Versions 6.5 and earlier are no longer supported and do not receive security fixes.
Mitigations
DIVD recommends upgrading to version 7 or taking the instance offline. Its advisory does not list a workaround.
Timeline
- September 24, 2026: DIVD reported the vulnerability to Zammad.
- September 26, 2026: DIVD issued a limited disclosure, scanned public instances, and began notifying owners.
- September 30, 2026: Publication date of the central CVE record. DIVD’s own advisory separately lists September 29.
- October 1, 2026: Zammad published its statement and recommended 7.2.0.
- October 2, 2026: CISA added CVE-2026-102489 to its Known Exploited Vulnerabilities catalog.
- October XX, 2026: Horizon3 alerted affected Rapid Response customers and released the NodeZero Rapid Response test for CVE-2026-102489