CVE-2026-102489: Zammad GmbH Zammad
Zammad GmbH Zammad contains a session fixation vulnerability that can lead to remote code execution as the zammad user. This vulnerability can be chained with CVE-2026-102490.
- Vendor
- Zammad GmbH
- Product
- Zammad
- Vulnerability
- Zammad GmbH Zammad Session Fixation Vulnerability
- Date added
- Oct 2, 2026
- CISA due date (U.S. federal agencies)
- Oct 5, 2026
- Known ransomware campaign use
- Unknown
- Weakness (CWE)
- CWE-384
References
This site summarizes CISA's catalog for information only. It is not security advice — follow your vendor's guidance and official advisories.
Last updated: · Catalog version 2026.10.02