CVE-2026-102489

Zammad's session fixation flaw allows remote code execution as the zammad user and is actively exploited in the wild.

Zammad contains a session fixation vulnerability that enables remote code execution as the zammad user, which can be chained with CVE-2026-102490. This is actively exploited in the wild, meaning DIB organizations using Zammad face immediate risk of compromise and data exfiltration. Organizations must patch immediately and assess their exposure to this actively exploited vulnerability.

Shame score — The vulnerability is actively exploited in the wild, indicating negligent security practices and a failure to patch known issues before they were weaponized by attackers.