CVE-2026-102489 · High · CISA KEV

Zammad Session Fixation Leads to RCE (CVE-2026-102489)

Threat Engine Auto-Feed · data current as of 2026-10-02

CVE-2026-102489, a session fixation vulnerability in Zammad, can be chained with other weaknesses to achieve remote code execution (RCE) as the Zammad user. This vulnerability is listed in CISA KEV, indicating active exploitation in the wild. Its EPSS percentile is 46%, suggesting moderate exploitability.

  • CVSS:
  • EPSS percentile: 0.45835
  • Exploitation pressure: 53/100 (High)

Exploitation reality: listed in CISA KEV (exploited in the wild) · EPSS 46th percentile. Threat × Vulnerability from public signals — impact depends on your environment.

Weakness —

Session fixation occurs when a web application allows an attacker to fixate a user's session ID. If a legitimate user then logs in using this fixed session ID, the attacker can hijack their session, gaining unauthorized access to the user's account and privileges.

Who's at risk

Exposure: unknown · Auth: unknown · unknown

Enterprise profiles most at risk

  • Organizations using Zammad for customer support or internal ticketing
  • Financial services organizations (due to actor targeting)
  • Technology companies (due to actor targeting)

Misconfigurations that escalate it

  • Lack of robust session management controls
  • Insufficient logging and monitoring of session activities

High-impact scenarios

  • Attacker gaining remote code execution as the Zammad user, potentially leading to data exfiltration or further system compromise.
  • Unauthorized access to sensitive customer or internal support data managed within Zammad.
  • Chaining with other vulnerabilities (e.g., CVE-2026-102490) to escalate privileges or impact.

Likely adversaries

  • FIN7 — Financial services (Assessed)
  • LockBit affiliates — Financial services (Assessed)
  • APT38 (Lazarus) — Financial services (Assessed)
  • APT29 (Cozy Bear) — Technology (Assessed)
  • Scattered Spider — Technology (Assessed)

What to do (defensive)

Detect

  • Monitor Zammad application logs for unusual session activity or unauthorized access attempts.
  • Implement security monitoring for remote code execution attempts or unexpected process execution from the Zammad user.

Contain

  • Isolate affected Zammad instances from the network if compromise is suspected.
  • Force all Zammad users to log out and invalidate existing sessions.

Patch

  • Apply the latest security patches and updates provided by Zammad GmbH for Zammad.

Frontier verdict — High

High priority due to active exploitation in the wild (CISA KEV) and potential for remote code execution.

For detection-engineering and awareness only · point-in-time · not security advice · sourced from NVD, FIRST EPSS, CISA KEV. Adversary mappings are assessments unless cited.