Firetruck

CVE-2026-102489

KEV
Updated Oct 19, 2026 · PUBLISHED
View KEV entry →

Description

Zammad GmbH Zammad contains a session fixation vulnerability that can lead to remote code execution as the zammad user. This vulnerability can be chained with CVE-2026-102490.

Full record on cve.org →

Affected packages

PackageVendor / ProductVersion rangeStatus
ZammadZammad GmbH / Zammad>= *, < 6.3.0unknown
ZammadZammad GmbH / Zammad>= 6.3.0, < 6.5.4affected
ZammadZammad GmbH / Zammad>= 7.0.0, < 7.1.3unknown