First published 10/2/2026, 4:57:15 PM · Last updated 10/2/2026, 4:57:15 PM

CVE-2026-102489: Zammad GmbH Zammad Session Fixation Vulnerability

CVE-2026-102489 is a session fixation vulnerability in Zammad GmbH’s Zammad that can be chained with CVE-2026-102490 and can lead to remote code execution as the zammad user. CISA advises applying vendor mitigations per its BOD 26-04 guidance or discontinuing use if mitigations are unavailable.

Categories: technology

Generated scores

Scores are based on the cited reporting and use a 1–10 scale. Read the methodology.

Confidence: 8/10How certain the assessment is based on the clarity and evidence in the cited reporting.
Geographic reach: 4/10How widely the event reaches, from a local area (1) to worldwide impact (10).
Global importance: 4/10The event's broader significance, from limited importance (1) to major global importance (10).
Impact magnitude: 4/10The scale or severity of the real-world impact, from minor (1) to extreme (10).
Positivity: 2/10How harmful or beneficial the event is, from strongly harmful (1) to strongly positive (10).
Urgency: 6/10How time-sensitive the event is, from low urgency (1) to immediate attention needed (10).

Why it matters

Unmitigated exploitation can result in remote code execution on affected systems and requires stakeholders to follow CISA patching and mitigation guidance.

Location

Sources

CVE-2026-102489: Zammad GmbH Zammad Session Fixation Vulnerability

Report an issue