{"id":"CVE-2026-102489","published":"2026-09-30T17:16:40.550","lastModified":"2026-10-03T04:17:56.693","description":"Zammad versions 6.3.0 to 6.5.4 are vulnerable a session hijack vulnerability that leads to remote code execution as the zammad user. The vulnerability is also present in version 7.0.0 to version 7.1.3, but not exploitable due to environment conditions.","cvssScore":9.8,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-384"],"vendors":["zammad","docker","linux"],"products":["zammad","docker","linux kernel"],"references":[{"url":"https://csirt.divd.nl/CVE-2026-102489","tags":["Third Party Advisory"]},{"url":"https://csirt.divd.nl/DIVD-2026-00015","tags":["Third Party Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-102489","tags":["US Government Resource"]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"Zammad versions 6.3.0 to 6.5.4 and 7.0.0 to 7.1.3 are vulnerable to a session hijack that can lead to remote code execution as the zammad user, with versions 7.0.0 to 7.1.3 not being fully exploitable due to environment conditions.","exploitability":"Exploitation is difficult due to the need for session hijacking, which requires the attacker to first gain access to a session token. The vulnerability is not fully exploitable in versions 7.0.0 to 7.1.3 due to environment conditions.","blast_radius":"If exploited, the vulnerability could allow an attacker to execute arbitrary code as the zammad user, potentially leading to full system compromise.","remediation":"Upgrade to Zammad version 6.5.5 or later, or apply the relevant security patches provided by the vendor.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["rce","web","session-hijack"],"model":"qwen2.5:7b-instruct","analyzedAt":"2026-10-03T08:44:04.826Z"}}