CVE-2026-102489

Vendor

Zammad GmbH

Product

Zammad

CISA KEV

added 2 Oct 2026, due 5 Oct 2026 (27d overdue)

Weakness

CWE-384

Every item in the archive that references this CVE, highest rank first. Headlines open the publisher.

1. 57
   KEV NVD 30 Sep 2026

   Zammad GmbH Zammad Session Fixation Vulnerability

   Zammad GmbH Zammad contains a session fixation vulnerability that can lead to remote code execution as the zammad user. This vulnerability can be chained with CVE-2026-102490.

   KEV · due 5 Oct 2026 (overdue) Fix available CVE-2026-102489 Zammad GmbH
2. 47
   CISA alert CISA 29d ago

   CISA Adds Two Known Exploited Vulnerabilities to Catalog

   CISA has added two new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog , based on evidence of active exploitation. CVE-2026-102489 Zammad GmbH Zammad Session Fixation Vulnerability CVE-2026-102490 Zammad GmbH…

   Exploited CVE-2026-102489CVE-2026-102490