CVE-2026-102489

CVE-2026-102489: Zammad Unauthenticated Remote Code Execution This repository contains a proof of concept for CVE-2026-102489, an unauthenticated remote code execution vulnerability in Zammad. The exploit chains a WebSocket information disclosure flaw into authenticated session takeover and...

CVE-2026-34724

🚨 CVE-2026-34724 - Zammad 7.0.1 - Server-Side Template Injection SSTI to Remote Code Execution RCE via AI Agent 📌 Overview Zammad is a popular open-source web-based helpdesk and customer support system. CVE-2026-34724 is a Server-Side Template Injection SSTI vulnerability in the new AI Agent...

Exploit for Session Fixation in Zammad

CVE-2026-102489 - The Cookie in the Error Message PoC materia...

Zammad Session Fixation RCE (CVE-2026-102489)

Exploits CVE-2026-102489 in Zammad 6.3.0–6.5.4: session fixation allows hijacking an authenticated session and achieving remote code execution as the zammad service user via admin scheduler/trigger APIs. Chain with CVE-2026-102490 for root privilege escalation. !/usr/bin/env python3 -- coding:...

Zammad CVE-2026-102489 Session Fixation Detect

Detects Zammad helpdesk instances potentially vulnerable to CVE-2026-102489 session fixation leading to RCE as the zammad user. Affects Zammad 6.3.0–6.5.4; chain with CVE-2026-102490 for root LPE. !/usr/bin/env python3 -- coding: utf-8 -- """Detect Zammad session fixation RCE surface...

Zammad Local Privilege Escalation (CVE-2026-102490)

Post-exploitation module for CVE-2026-102490: escalates from the zammad service user to root on Zammad installations when a writable sudoers drop-in, cron job, or package hook is abusable. Intended as the second stage after CVE-2026-102489 session fixation RCE. !/usr/bin/env python3 -- coding:...

Dutch Institute for Vulnerability Disclosure Breached via Zammad 0-Days

Dutch Institute for Vulnerability Disclosure was breached through two Zammad 0-days in an AI-powered attack that led to remote code execution and root access...

CISA Adds Two Known Exploited Vulnerabilities to Catalog

CISA has added two new vulnerabilities to its Known Exploited Vulnerabilities KEV Catalog, based on evidence of active exploitation. CVE-2026-102489 Zammad GmbH Zammad Session Fixation Vulnerability CVE-2026-102490 Zammad GmbH Zammad Improper Privilege Management Vulnerability These types of...

Zammad GmbH Zammad Session Fixation Vulnerability

Zammad GmbH Zammad contains a session fixation vulnerability that can lead to remote code execution as the zammad user. This vulnerability can be chained with CVE-2026-102490...

Zammad GmbH Zammad Improper Privilege Management Vulnerability

Zammad GmbH Zammad contains an improper privilege management vulnerability that can allow the local zammad user to escalate privileges to root. This vulnerability can be chained with CVE-2026-102489...

Vulnerabilities found in Zammad

Two vulnerabilities associated with zeroday have been identified in Zammad. The first vulnerability has been assigned the identifier CVE-2026-102489. This vulnerability allows unauthorized malicious actors to execute arbitrary code remotely. It is present in Zammad versions 6.3.0 through 6.5.4. T...

CVE-2026-102489

Zammad versions 6.3.0 to 6.5.4 are vulnerable a session hijack vulnerability that leads to remote code execution as the zammad user. The bug is also present in version 7.0.0 to version 7.1.2, but not exploitable due to changes in the underlying framework...

CVE-2026-102490

Zammad packages built with packager.io DEB and RPM could have allowed a local attacker who already had file system write privileges as the unprivileged zammad service account to escalate to full root privileges on the host. Service processes began running as root and executed files that were owne...

CVE-2026-102490 Local privilege escalation in Zammad v1.5.0 to v7.2.2 installed via DEB or RPM package

Zammad packages built with packager.io DEB and RPM could have allowed a local attacker who already had file system write privileges as the unprivileged zammad service account to escalate to full root privileges on the host. Service processes began running as root and executed files that were owne...

CVE-2026-102490

All versions of Zammad , including the latest alpha, are vulnerable to a local privilege escalation (LPE) flaw. This vulnerability allows a local zammad user to escalate their privileges to root on the system where Zammad is running. The issue has been identified as actively exploited in the wild...

EUVD-2026-90081

All versions of Zammad including the latest alpha enable the local zammad user to escalate privileges to root...

CVE-2026-102490 Local privilege escalation in Zammad v1.5.0 to v7.2.2 installed via DEB or RPM package

Zammad packages built with packager.io DEB and RPM could have allowed a local attacker who already had file system write privileges as the unprivileged zammad service account to escalate to full root privileges on the host. Service processes began running as root and executed files that were owne...

CVE-2026-102490 Local privilege escalation in Zammad v1.5.0 to v7.2.2 installed via DEB or RPM package

Zammad packages built with packager.io DEB and RPM could have allowed a local attacker who already had file system write privileges as the unprivileged zammad service account to escalate to full root privileges on the host. Service processes began running as root and executed files that were owne...

EUVD-2026-90080

Zammad versions 6.3.0 to 6.5.4 are vulnerable a session hijack vulnerability that leads to remote code execution as the zammad user. The vulnerability is also present in version 7.0.0 to version 7.1.3, but not exploitable due to environment conditions...

CVE-2026-102489 Undisclosed RCE in Zammad v6.3 and higher

Zammad versions 6.3.0 to 6.5.4 are vulnerable a session hijack vulnerability that leads to remote code execution as the zammad user. The bug is also present in version 7.0.0 to version 7.1.2, but not exploitable due to changes in the underlying framework...