A proof-of-concept exploit has surfaced for a serious security flaw in Zammad—CVE-2026-102489—that enables remote, unauthenticated users to hijack active session cookies and potentially achieve remote code execution on affected systems.
What the Vulnerability Does
The flaw affects Zammad versions 6.3.0 through 6.5.4. In versions 7.0.0 to 7.1.3, the same vulnerable code exists but supposedly without the right environment for exploitation. By targeting Zammad’s WebSocket event handler via the “/ws” endpoint, the exploit sends a payload (e.g. {“event”:”base”}) that triggers application errors. Rather than clean error messages, those errors can expose internal WebSocket connection data, including the _zammad_session cookie. That session cookie, if belonging to an administrator, grants access without multi-factor authentication.
From Session Hijack to Remote Code Execution
Once attacker gains an admin’s session cookie, they may use Zammad’s package installation feature to write arbitrary files into the application directory. These files can replace trusted templates with malicious ERB scripts, allowing code execution under the Zammad service account (though not with root privileges). To succeed, the attack also requires at least one authenticated WebSocket user to be connected at the time of the exploit, which makes public-facing Zammad deployments especially vulnerable.
Context & Response
The vulnerability was identified during investigations into a breach at the Dutch Institute for Vulnerability Disclosure (DIVD), traced back to two zero-day flaws in Zammad. CVE-2026-102489—this session hijack and RCE risk—is one of them. The second, CVE-2026-102490, allows local privilege escalation that could let Zammad’s OS user gain root access; details on this flaw remain under wraps and had not been fully patched at the time of disclosure.
Mitigation & What Admins Should Do
To protect their systems, administrators are urged to upgrade to Zammad version 7, or otherwise take vulnerable instances offline until patches are confirmed. DIVD has released a log-scanning script to help spot signs of session cookie leaks. Because the flaw may have been exploited before public disclosure, preserving logs and evidence before making any changes or rebuilds is strongly advised. The guidance is not just about patching—it’s a prompt for teams to assess potential exposure and remediate broadly.
These revelations underscore the risks in helpdesk platforms, which often hold customer data, internal support conversations, and operational control interfaces. A breach here can cascade into much larger damage if an attacker leverages admin access or code execution.
Analysis: This vulnerability isn’t just another bug—it combines session hijacking with the potential for remote code execution in one chain, making it particularly dangerous. Organizations using Zammad need to act fast: public exposure means widespread attack surface. Going forward, security audits should focus not only on code flaws but also on how error handling and live connection data are managed. Monitoring for unusual WebSocket traffic or errors might provide early warning systems ahead of formal disclosure or patch availability.
