CVE-2026-102489

Zammad is customer support/helpdesk software many small businesses use to manage tickets and customer conversations. This flaw is like someone being able to walk up and borrow an employee's badge without ever showing ID, then use that badge to unlock the back office and run their own commands on your systems. Once in, they could read customer data, disrupt your support operations, or use the server as a foothold for further attacks.

This matters to you if you self-host Zammad to manage customer support tickets. You're at risk if your Zammad version falls in the 6.3.0–6.5.4 range (actively exploitable) or in the newer 7.0.0–7.1.3 range (flaw present but currently not exploitable under normal setups). No login or user action is needed for an attacker to exploit this if your Zammad is reachable from the internet.

Attackers are already exploiting this flaw in the wild, and it's on CISA's official list of known-exploited vulnerabilities with a remediation deadline of October 5, 2026 — just two days away. This requires immediate action, not routine patching on your normal schedule. Treat any internet-facing Zammad instance in the vulnerable version range as compromised until proven otherwise.

Confirm exposure by checking your running Zammad version and whether the instance is reachable from the public internet (reachability is not required for risk here — the flaw is exploitable even without internet exposure checks noted, so treat all affected instances as at risk). Versions 6.3.0 through 6.5.4 are confirmed exploitable; upgrade to 6.5.4 or later immediately. Versions 7.0.0 through 7.1.3 contain the same code path but are not exploitable under normal environment conditions — nonetheless, upgrade to the latest 7.x release as defense-in-depth, since conditions may vary by deployment. There is no published workaround beyond patching or taking the service offline; CISA's guidance is to apply the vendor fix or discontinue use if mitigation isn't possible, with a remediation due date of 2026-10-05. After patching, review authentication logs, active sessions, and any unexpected commands or processes run under the zammad service account for signs of prior compromise. No public exploit code is currently on record, but KEV listing confirms active exploitation, so monitor vendor advisories for IOCs.

CVSS 9.8 (Critical), AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H — network-exploitable, no privileges or user interaction required, full impact to confidentiality, integrity, and availability. Weakness is CWE-384 (Session Fixation), allowing unauthenticated session hijack that chains into remote code execution. Confirmed in CISA KEV (added 2026-10-02, remediation due 2026-10-05), which supersedes the EPSS prediction (0.6%, 46th percentile, flat trend) as the operative signal — exploitation is confirmed, not merely predicted. No public exploit code is on record, but KEV status confirms active in-the-wild exploitation. Press coverage ties this to actor 'Tren de Aragua' per a roundup-style report, though this should not independently drive urgency beyond the KEV confirmation.