CVE-2026-102489
Auth Bypass in Zammad 6.3.0 – 6.5.4
Raw vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:A/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:X/V:C/RE:X/U:XCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2026-102489 is a critical-severity Session Fixation (CWE-384) vulnerability in Zammad Zammad. Its CVSS base score is 9.4 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Steal Web Session Cookie (T1539); ranked in the top 31% of CVEs by exploit likelihood; CISA has added it to the Known Exploited Vulnerabilities catalog.
The strongest mitigations our analysis identified map to AC-3 (Access Enforcement) and SC-23 (Session Authenticity) — see the control section below for these in your framework.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-90080
Vulnerability Data
Zammad versions 6.3.0 to 6.5.4 are vulnerable a session hijack vulnerability that leads to remote code execution as the zammad user. The bug is also present in version 7.0.0 to version 7.1.2, but not exploitable due to changes in the…
more
underlying framework.
- CWE(s)
- KEV Date Added
- 02 October 2026
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
—
V4.4.4V7.6.2
Mitigating Controls (NIST 800-53 r5) AI
Enforces that only properly authorized (i.e., freshly authenticated) sessions can access resources, making a pre-existing fixed session ID unusable.
Requires protection of session authenticity, which directly stops an attacker from using a stolen or fixed session identifier after authentication.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Managing identities and credentials includes handling session identifiers as temporary credentials that must be invalidated on re-authentication.
Proper authentication processes must invalidate prior session identifiers to prevent fixation attacks.
Protecting and verifying identity assertions encompasses secure handling and regeneration of session tokens.
Configuration baselines can enforce session regeneration and timeout settings that block fixation.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.