cve-2026-102489
CRITICAL CVSS 9.4 circl_kev
Description
Affected: Zammad / Zammad | Description: Zammad versions 6.3.0 to 6.5.4 are vulnerable a session hijack vulnerability that leads to remote code execution as the zammad user. The vulnerability is also present in version 7.0.0 to version 7.1.3, but not exploitable due to environment conditions. | Patched since: 2026/04/08 | Exploitation type: unknown | Origin source: NCSC-NL | Notes: https://www.ncsc.nl/alerts/actief-misbruik-van-zeroday-kwetsbaarheden-in-zammad-update-nu
Timeline
- Published
- Last Modified
CVSS Details
CVSS details not available.
Affected Products
No product information available.
References
No references available.
Linked Vulnerabilities
No linked vulnerabilities found.
{
"cvss": 9.4,
"datePublished": "",
"dateUpdated": "",
"description": "Affected: Zammad / Zammad | Description: Zammad versions 6.3.0 to 6.5.4 are vulnerable a session hijack vulnerability that leads to remote code execution as the zammad user. The vulnerability is also present in version 7.0.0 to version 7.1.3, but not exploitable due to environment conditions. | Patched since: 2026/04/08 | Exploitation type: unknown | Origin source: NCSC-NL | Notes: https://www.ncsc.nl/alerts/actief-misbruik-van-zeroday-kwetsbaarheden-in-zammad-update-nu",
"dueDate": "",
"exploited": true,
"id": "CVE-2026-102489",
"kev_catalogs": [
"circl"
],
"knownRansomwareCampaignUse": "",
"product": "Zammad",
"severity": "CRITICAL",
"source": "circl_kev",
"title": "CVE-2026-102489",
"vendor": "Zammad"
}
Enrichment data
Aggregated bundle (all enrichments)