Exploit for Session Fixation in Zammad

CVE-2026-102489 - The Cookie in the Error Message PoC materia...

Zammad GmbH Zammad Session Fixation Vulnerability

Zammad GmbH Zammad contains a session fixation vulnerability that can lead to remote code execution as the zammad user. This vulnerability can be chained with CVE-2026-102490...

EUVD-2026-90080

Zammad versions 6.3.0 to 6.5.4 are vulnerable a session hijack vulnerability that leads to remote code execution as the zammad user. The vulnerability is also present in version 7.0.0 to version 7.1.3, but not exploitable due to environment conditions...

CVE-2026-102489 Undisclosed RCE in Zammad v6.3 and higher

Zammad versions 6.3.0 to 6.5.4 are vulnerable a session hijack vulnerability that leads to remote code execution as the zammad user. The bug is also present in version 7.0.0 to version 7.1.2, but not exploitable due to changes in the underlying framework...

PT-2026-103453

Name of the Vulnerable Software and Affected Versions Zammad versions 6.3.0 through 6.5.4 Description A session hijack issue allows for remote code execution as the zammad user. Approximately 12,000 instances have been identified globally. Recommendations At the moment, there is no information...

CVE-2026-102489: Session Fixation

Zammad versions 6.3.0 to 6.5.4 are vulnerable a session hijack vulnerability that leads to remote code execution as the zammad user. The bug is also present in version 7.0.0 to version 7.1.2, but not exploitable due to changes in the underlying framework...