Source: cisa.gov
Zammad GmbH's Zammad helpdesk/ticketing application contains a session fixation vulnerability tracked as CVE-2026-102489 that can lead to remote code execution as the zammad user. This vulnerability can be chained with a local privilege escalation vulnerability CVE-2026-102490, which is reported as being actively exploited in the wild. The chained exploitation allows attackers to escalate from session fixation to full system compromise. CISA has flagged this under BOD 26-04, which prioritizes security updates based on risk. Forensic triage requirements have been outlined in BOD 26-04 implementation guidance. Users are advised to apply the latest patches referenced in Zammad's official releases page. The Zammad community forum has posted an alert regarding active exploitation of the privilege escalation component. NVD has published details for CVE-2026-102489.
