Is CVE-2026-102489 actively exploited?

Yes. Previdian has observed exploitation attempts targeting this CVE. Confidence is confirmed.

What exploitation activity has Previdian observed?

Previdian sensors have observed 10 exploitation attempts, 8 unique attacker IPs, and 5 countries targeting CVE-2026-102489. First observed Oct 07, 2026; last observed Oct 08, 2026.

Which versions are affected?

CVE-2026-102489 affects Zammad. Reported affected version: 6.3.0 to < 6.5.4.

How should organizations remediate it?

Prioritize immediate patching and validate internet-facing exposure. Monitor for matching exploitation attempts in your environment.

Yes. CVE-2026-102489 is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Added to Previdian from a trusted third-party report 2 days before CISA listed it.

CVE-2026-102489 Exploitation Observed — Zammad

Q: How should organizations remediate it?

Prioritize immediate patching and validate internet-facing exposure. Monitor for matching exploitation attempts in your environment.

Q: Is it in CISA KEV?

Yes. CVE-2026-102489 is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Added to Previdian from a trusted third-party report 2 days before CISA listed it.

Decision summary

What security teams need to know first

Direct answers before the deeper technical record.

What it is

CVE-2026-102489 is an unauthenticated Undisclosed RCE in Zammad v6.3 and higher. Zammad versions 6.3.0 to 6.5.4 are vulnerable a session hijack vulnerability that leads to remote code execution as the zammad user. The...

Is it exploited?

Yes. Previdian sensors observed exploitation attempts with confirmed confidence. Listed in CISA KEV. Also confirmed by third-party sources.

Who is affected?

Zammad affected before 6.5.4.

What should we do?

Patch immediately, validate internet-facing exposure, and monitor for matching requests.

Overview

Undisclosed RCE in Zammad v6.3 and higher

Zammad versions 6.3.0 to 6.5.4 are vulnerable a session hijack vulnerability that leads to remote code execution as the zammad user.

The bug is also present in version 7.0.0 to version 7.1.2, but not exploitable due to changes in the underlying framework.

Vendor Product Affected Status

Zammad GmbH Affected

Zammad

Before 6.5.4

Affected

View vendor advisory

Published: 30 Sep 2026
Exploitation Reported: 30 Sep 2026
Attack vector: Remote
Complexity: Low
Privileges: None
User interaction: —

CVE References

CVE Record CVE.org · CVE Record https://www.cve.org/CVERecord?id=CVE-2026-102489
Vendor Advisory — zammad.com zammad.com · Vendor Advisory https://zammad.com/en/advisories/cve-2026-102489-cve-2026-102490
Third-Party Advisory — csirt.divd.nl csirt.divd.nl · Third-Party Advisory https://csirt.divd.nl/DIVD-2026-00015
Third-Party Advisory — csirt.divd.nl csirt.divd.nl · Third-Party Advisory https://csirt.divd.nl/CVE-2026-102489
Technical Description — community.zammad.org community.zammad.org · Technical Description https://community.zammad.org/t/take-care-local-privilege-escalation-c...

Exploitation evidence

Why Previdian marks this CVE as exploited

Third-party attestation and first-party sensor observation are shown separately so teams can judge the evidence chain.

Exploited in the wild

NCSC Security Advisories

Recorded 30 Sep 2026

A trusted third party reported exploitation.

Active exploitation observed

Previdian sensor

First observed 07 Oct 2026

Previdian first observed exploitation attempts targeting this vulnerability in our honeypot sensors.

Proof of concept available

GitHub

Recorded 06 Oct 2026

Public scanner or PoC coverage increases practical exploitability.

Known exploited vulnerability sources

Per-source evidence links for KEV attestations are available through the Previdian Pro API.

Learn about Pro API access

Source	Added
NCSC Security Advisories First	2026-09-30 18:52 UTC
CISA	2026-10-02 15:50 UTC
CVE	2026-10-07 14:10 UTC
Previdian Sensors	2026-10-07 14:22 UTC

Operational indicators for this CVE are listed under Detection.

Sensor telemetry

First-party evidence of exploitation activity

Previdian sensors recorded exploitation attempts targeting this vulnerability. The cards and chart show volume, unique attackers, and daily activity.

10

Attempts observed

8

Unique attacker IPs

5

Attacker countries

CH · FR · NL · SG · US

1

Sensors observed

CVE-2026-102489 exploitation attempts over the last 7 days

Daily events observed by Previdian sensors

Updated 10 Oct 2026

0

4

6

0

4 Oct 5 Oct 6 Oct 7 Oct 8 Oct 9 Oct 10 Oct

First observed 07 Oct 2026 · Last observed 08 Oct 2026

Pro adds sensor region and window summaries. Enterprise adds raw IPs, paths, User-Agents, and payloads.

Start 14-day Pro trial

Detection

Operational artifacts and observed signals

Make the evidence actionable in scanner, SOC, and edge-control workflows.

Observed signals

Request targets
User-Agents
Callback hosts: 1; 0; 0

Request targets and User-Agents available in Pro. Callback host details available in Enterprise.

Scanner coverage

No scanner integrations recorded yet.

Virtual patch status

No Previdian virtual patch is currently available. Future rules ship for ModSecurity, Cloudflare, and AWS WAF.

Learn about virtual patches →

Attacker IP Indicators

Attacker IP indicators observed · available in Pro and Enterprise.

Sensor-derived attacker IP indicators are available to Pro and Enterprise accounts under Detection and through the Pro API.

Learn about Pro API access

Risk and context

Severity, weaknesses, and research context

CVSS v4.0

8.7 High

Potential damage if exploited. Separate from whether attackers are using it.

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:A/AU:Y/V:C

EPSS

1.3%

Estimated chance of exploitation in the next 30 days. Previdian's warning comes from evidence, not this score.

Weaknesses

Session Fixation CWE-384

Recent mention · Horizon3.ai Attack Research

07 Oct 2026

Zammad CVE-2026-102489: Session Leak to RCE

Horizon3 reverse engineered CVE-2026-102489 in Zammad, reproduced the unauthenticated WebSocket session leak, traced the vulnerable code path, and demonstrated how a leaked admin session can lead to remote code execution.

Read full advisory

All CVSS Scores

CVSS v4.0 8.7 High

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:A/AU:Y/V:C

CVSS v3.1 9.8 Critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

All Mentions

Recent mention · Horizon3.ai Attack Research

Zammad CVE-2026-102489: Session Leak to RCE

Horizon3.ai Attack Research · 07 Oct 2026

Horizon3 reverse engineered CVE-2026-102489 in Zammad, reproduced the unauthenticated WebSocket session leak, traced the vulnerable code path, and demonstrated how a leaked admin session can lead to remote code execution.

Recent mention · Security Affairs

U.S. CISA adds Zammad GmbH Zammad flaws to its Known Exploited Vulnerabilities catalog

Security Affairs · 02 Oct 2026

U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Zammad GmbH Zammad flaws to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added the following vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog: The first flaw, CVE-2026-102489, is a session hijacking vulnerability in Zammad that can lead to remote code execution as the […]

Recent mention · TheRegister

AI agents hacked the hackers, stealing email addresses from security research org

TheRegister · 01 Oct 2026

Chained Zammad flaws enabled session hijacking, code execution, and root escalation in seconds

Recent mention · The Hacker News

ThreatsDay: AI-Powered Zero-Day Chain, 543K Live Secrets, Model Inspection RCE and 13 More Stories

The Hacker News · 01 Oct 2026

This week, the useful words are boring ones: inspect, cache, compile, store, trust. Each sounds harmless. Each can become an attack path when a system does a little more than people expect. A model check can run code. A cache can mix up requests. A public secret can stay useful for years. That is the lesson running through the list. Attackers do not always need a brilliant new trick. They can

Recent mention · Security Affairs

AI Agent Chains Zammad Zero-Days To Take Over DIVD Systems in Seconds

Security Affairs · 01 Oct 2026

DIVD was breached through two Zammad zero-days that let an AI agent reach root in seconds, steal data and pivot to other services before being stopped. The Dutch Institute for Vulnerability Disclosure, a nonprofit organization of volunteer security researchers whose whole job is finding and responsibly disclosing vulnerabilities in other people’s software, just disclosed that […]

Recent mention · NCSC Security Advisories

NCSC-2026-0396 [1.00] [H/H] Kwetsbaarheden aangetroffen in Zammad

NCSC Security Advisories · 30 Sep 2026

Er zijn twee zeroday-kwetsbaarheden aangetroffen in Zammad. De eerste kwetsbaarheid heeft het kenmerk CVE-2026-102489 toegekend gekregen. De kwetsbaarheid stelt een ongeauthenticeerde kwaadwillende op afstand in staat om willekeurige code uit te voeren. De kwetsbaarheid is aanwezig in Zammad versies 6.3.0 tot en met 6.5.4. De tweede kwetsbaarheid heeft het kenmerk CVE-2026-102490 toegekend gekregen. Deze kwetsbaarheid stelt een kwaadwillende die over lage rechten beschikt in staat om rootrechten te verkrijgen op het kwetsbare systeem. Deze kwetsbaarheid is aanwezig in alle gangbare versies...

Potential Proof of Concepts

These PoCs are unverified and could contain malware. Use at your own risk.

horizon3ai/CVE-2026-102489

github · Created 2026-10-06 19:00:36 UTC · 0 stars · AI assessment 90%

Zammad Session Leak to Remote Code Execution

Timeline

From disclosure to observed exploitation

07 Oct 2026
14:10 UTC

KEV confirmed by CVE

Exploitation attested by an external source
07 Oct 2026
11:29 UTC

Indicators of compromise added (8)

Indicators of compromise recorded
07 Oct 2026
11:29 UTC

Observed by Previdian sensors

Evidence-backed exploitation signal
06 Oct 2026
19:00 UTC

Public PoC available

Public proof-of-concept code published
02 Oct 2026
15:50 UTC

Added to CISA KEV

Listed in the CISA Known Exploited Vulnerabilities catalog
30 Sep 2026
18:52 UTC

Added to Previdian KEV Feed

High-confidence, third-party attested exploitation
30 Sep 2026
16:21 UTC

CVE published

Vulnerability disclosed publicly
29 Sep 2026
09:46 UTC

CVE ID reserved

Identifier reserved by the CNA

Pro API

Automate this intelligence

Confidence, exploit status, sensor telemetry, PoCs, scanner integrations, mentions, and tags are available programmatically for VM, SOC, and CTI workflows.

Start 14-day Pro trial Read API docs

Evidence confidence and provenance
First-party sensor telemetry
PoC and scanner references
Affected versions and enrichment
Automation-ready JSON delivery

GET /api/v2/pro/kevs/CVE-2026-102489

Free JSON includes basic KEV fields

{
  "cve_id": "CVE-2026-102489",
  "confidence": "Confirmed",
  "cvss_score": 8.7,
  "cvss_estimated": false,
  "epss_score": 0.01255,
  "exploit_status": {
    "exploited_in_the_wild": true,
    "active_exploitation_observed": true
  },
  "sensor_telemetry": { "attempts": 10, "sensors": 1 }
}

CVE-2026-102489

Undisclosed RCE in Zammad v6.3 and higher

Tags

CVE References

Exploited in the wild

Active exploitation observed

Proof of concept available

Known exploited vulnerability sources

Observed signals

Scanner coverage

Virtual patch status

Attacker IP Indicators

Weaknesses

Zammad CVE-2026-102489: Session Leak to RCE

All CVSS Scores

All Mentions

Potential Proof of Concepts

KEV confirmed by CVE

Indicators of compromise added (8)

Observed by Previdian sensors

Public PoC available

Added to CISA KEV

Added to Previdian KEV Feed

CVE published

CVE ID reserved

Automate this intelligence