Critical Zammad Session Fixation Vulnerability Enables Remote Code Execution…

An unauthenticated Zammad session fixation vulnerability tracked as CVE-2026-102489 allows remote attackers to hijack active user sessions and achieve arbitrary code execution as the zammad user. Assigned a CVSS v3.1 score of 9.8 (CRITICAL), the underlying flaw stems from improper session management (CWE-384) in Zammad’s web application framework, requiring low attack complexity and zero prior privileges or user interaction to exploit.

Mechanics of the Zammad Session Fixation Vulnerability

The flaw arises when Zammad fails to properly invalidate or regenerate session identifiers during authentication workflows. An unauthenticated remote attacker can pre-determine or manipulate a valid session identifier and trick a target user into authenticating under that specific session context. Once the user logs in—particularly an administrative account—the attacker retains access to the newly authenticated session state.

The fully articulated attack vector is defined by CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. Once an administrative session is fixed and hijacked, the attacker can leverage elevated internal administrative capabilities. By chaining this issue with CVE-2026-102490, an attacker turns administrative control into arbitrary remote code execution (RCE) on the underlying host operating as the zammad service account.

Assessing Exposure and Priority

Helpdesk platforms like Zammad occupy a sensitive boundary in corporate networks. They process internal technical support tickets, customer PII, API tokens, integration secrets, and administrative credentials. A compromise at the host level gives attackers direct access to the application’s underlying database, Redis instance, and backend worker jobs, creating a prime launchpad for internal lateral movement.

While current measured EPSS data places the 30-day exploitation probability at 0.58% (putting it in the 45.8th percentile across all tracked vulnerabilities), this low statistical baseline should not breed complacency. The zero-requisite nature of the attack vector, combined with full host context execution upon chaining, makes public instances high-priority targets for automated scanning and targeted access brokers once technical proof-of-concept details become widespread.

Remediation and Response Steps

Organizations running self-hosted Zammad instances must immediately inspect their deployment versions and apply the corresponding security releases:

• Zammad 6.x branches: Upgrade instances running versions 6.3.0 through 6.5.3 to version 6.5.4 or higher.
• Zammad 7.x branches: Upgrade instances running versions 7.0.0 through 7.1.3 to version 7.1.4 (or the latest fixed release in the 7.x lineage).

For organizations bound by federal binding operational directives, compliance mandates completing these mitigations by October 5, 2026, adhering to BOD 26-04 guidance for risk-based priority patching and cloud service controls.

If an unpatched instance was exposed to the public internet, administrators should conduct forensic triage before relying solely on a patch:

1. Revoke all active web session tokens in Redis/PostgreSQL to immediately invalidate existing session cookies across all users.
2. Review web server access logs for requests establishing pre-login session cookies that persist into administrative endpoints.
3. Check system logs for unauthorized processes spawned under the zammad system user account or modified webhooks and custom background tasks.