Vendor

zammad

49 known vulnerabilities.

Products

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

Critical 9.4

CVE-2026-102489 Exploited Public exploit EPSS 50%

Undisclosed RCE in Zammad v6.3 and higher

Zammad versions 6.3.0 to 6.5.4 are vulnerable a session hijack vulnerability that leads to remote code execution as the zammad user. The bug is also present in version 7.0.0 to version 7.1.2, but not exploitable due to changes in the underlying framework.

zammad zammad

Sep 30, 2026
KEV Oct 2, 2026