CISA Flags Exploited Zammad Session Flaw Leading to Code Execution
CISA lists an exploited session flaw with code execution as the Zammad user. Zammad says 6.5 and older are exploitable; move those installations to 7.2.0 and triage exposure.
A Zammad helpdesk still running the old session environment now has an exploited remote-code-execution problem to address. On October 2, CISA listed CVE-2026-102489 as exploited. Its entry says session fixation can lead to code execution as the zammad user. CISA also says attackers can chain the flaw with CVE-2026-102490, a reported local privilege escalation.
Zammad says exploitation of the session flaw is possible on version 6.5 and older because of their runtime environment. Those releases are out of support. Its advice is to update to 7.2.0, the current stable release. The October 5 deadline in CISA’s catalog applies to federal remediation; other operators have the same urgent exposure question without that federal deadline.
The session becomes an entry point
Session fixation lets an attacker arrange for a user to authenticate under a session identifier the attacker already knows. The attacker can then use that authenticated session. The DIVD-assigned CVE record calls the flaw session hijacking and says the resulting access can execute code as the application account. It marks user interaction as passive in its severity assessment. For defenders, the first inventory fields are the installed release and whether users outside the trusted network can reach the helpdesk.
In DIVD’s structured record, affected versions run from 6.3.0 up to but not including 6.5.4, while its prose includes 6.5.4. Zammad’s assessment covers 6.5 and older. Treat an installation at 6.5.4 as needing the vendor’s recommended upgrade rather than assuming the boundary in the structured record makes it safe.
Zammad says, “Zammad 7.0 and later are not affected.” DIVD says the code remains in 7.0.0 through 7.1.3 but cannot be exploited there in practice because of environmental conditions. Zammad hardened the code in 7.2.0; that change is a defense-in-depth improvement for newer releases, while the older runtime is the immediate exposure.
Zammad disputes the escalation claim
CISA names CVE-2026-102490 as a possible next step after code execution as zammad. DIVD’s second CVE record describes local escalation from that service account to root and lists versions from 1.5.0 to before 7.1.0-alpha. Zammad says it has received no technical details for that report and cannot confirm the flaw or its affected versions. Keep that dispute attached to any root-access assessment; the known first-stage code-execution risk on older installations already warrants action.
CISA marks forensic triage required for the exploited session flaw. An operator investigating an already reachable old installation should preserve and examine its application and host records for unexpected sessions and activity by the zammad account. Preserve those records before the upgrade or rebuild changes the host.
Move old helpdesks off exposure
Inventory self-hosted Zammad instances, record their installed version and whether the login page is reachable from the internet or untrusted networks, then upgrade 6.5 and older installations to 7.2.0 following Zammad’s guidance. Restrict access to the helpdesk while arranging the move where your support workflow permits it. For an installation that was reachable while running an older version, preserve session, application and host records for the triage CISA requires before rotating credentials or rebuilding.
Compare the version reported by the running instance with the deployed package or container after the change; both should identify the intended release. Continue following Zammad’s advisories for CVE-2026-102490 because its scope remains disputed.