CVE-2026-102489

Zammad versions 6.3.0 to 6.5.4 are vulnerable to a session hijack vulnerability that allows for remote code execution (RCE) as the zammad user. While the flaw also exists in versions 7.0.0 to 7.1.3 , it is not exploitable in those versions due to specific environment conditions. This vulnerabilit...

CVE-2026-102489 Undisclosed RCE in Zammad v6.3 and higher

Zammad versions 6.3.0 to 6.5.4 are vulnerable a session hijack vulnerability that leads to remote code execution as the zammad user. The bug is also present in version 7.0.0 to version 7.1.2, but not exploitable due to changes in the underlying framework...

CVE-2026-102490

creationtimestamp| type| source ---|---|--- 2026-09-30 11:44:28+00:00| seen| https://www.ncsc.nl/alerts/actief-misbruik-van-zeroday-kwetsbaarheden-in-zammad-update-nu 2026-09-30 15:31:14+00:00| seen| https://advisories.ncsc.nl/advisory?id=NCSC-2026-0396 2026-09-30 18:08:34+00:00| seen|...

CVE-2026-102489

creationtimestamp| type| source ---|---|--- 2026-09-30 11:44:28+00:00| seen| https://www.ncsc.nl/alerts/actief-misbruik-van-zeroday-kwetsbaarheden-in-zammad-update-nu 2026-09-30 15:31:14+00:00| seen| https://advisories.ncsc.nl/advisory?id=NCSC-2026-0396 2026-09-30 18:08:25+00:00| seen|...

CVE-2026-102490: Improper Privilege Management

Zammad packages built with packager.io DEB and RPM could have allowed a local attacker who already had file system write privileges as the unprivileged zammad service account to escalate to full root privileges on the host. Service processes began running as root and executed files that were owne...

VulnCheck KEV: CVE-2026-102490

Zammad GmbH Zammad contains an improper privilege management vulnerability that can allow the local zammad user to escalate privileges to root. This vulnerability can be chained with CVE-2026-102489...

PT-2026-103454

Name of the Vulnerable Software and Affected Versions Zammad versions 1.5.0 through 7.1.0-alpha Description Improper privilege management allows a local zammad user to escalate privileges to root. Recommendations At the moment, there is no information about a newer version that contains a fix for...

VulnCheck KEV: CVE-2026-102489

Zammad GmbH Zammad contains a session fixation vulnerability that can lead to remote code execution as the zammad user. This vulnerability can be chained with CVE-2026-102490...

CVE-2026-102489: Session Fixation

Zammad versions 6.3.0 to 6.5.4 are vulnerable a session hijack vulnerability that leads to remote code execution as the zammad user. The bug is also present in version 7.0.0 to version 7.1.2, but not exploitable due to changes in the underlying framework...

PT-2026-103453

Name of the Vulnerable Software and Affected Versions Zammad versions 6.3.0 through 6.5.4 Description A session hijack issue allows for remote code execution as the zammad user. Approximately 12,000 instances have been identified globally. Recommendations At the moment, there is no information...

CVE-2026-84465

Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, when Zammad checks the digital signature on an incoming S/MIME-signed email, it does not verify that the signing certificate is genuinely trusted, it only checks whether a certificate with a matching name is alrea...

CVE-2026-84461

Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, the two-factor login step let an attacker try unlimited password guesses for any account without triggering Zammad's normal lockout or rate limiting. The response also revealed whether a guess was correct, even...

CVE-2026-84463

Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, a user with Knowledge Base editing rights for a category can embed a video widget in a published answer with a specially crafted value. When the answer is rendered, that value is inserted into the page's HTML...

CVE-2026-84464

Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, zammad's External Data Source feature, used to look up records from an external system, did not properly verify whether a user was allowed to see a specific ticket, user, group, or organization before including it...

CVE-2026-84458

Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, when the "Automatic account link on initial logon" setting is enabled, Zammad binds an incoming third-party SSO identity to an existing local account by matching the email address the identity provider reports,...

CVE-2026-84460

Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, any authenticated user can call the REST endpoint for getting a tag list and receive the tag names for the given ticket, regardless of whether they have access to that ticket. Tags are an internal categorization...

CVE-2026-63207

Zammad is a web based open source helpdesk/customer support system. In 7.0.3 and 7.1.1, an authenticated administrator can obtain stored integration credentials in cleartext through the integration administration API. Certain responses do not consistently mask sensitive fields, so configured...

CVE-2026-63216

Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, unsanitized option labels are rendered in the configuration dialogs of AI Agents within Zammad's admin UI. When rendering the list of selected options, the option label is output as raw HTML without escaping. An...

CVE-2026-63208

Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, when a Microsoft Graph request fails, Zammad logs the error including the authentication token used to access the mailbox. The system attempts to hide this token in the log, but the masking is incomplete: for the...

CVE-2026-63204

Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, an authenticated user with agent permissions can supply an arbitrary AI analytics run identifier to the ticket summarize endpoint and receive the AI provider error message stored for that run, even if the run...