Vulnerabilities in Zammad Ticketing System Under Active Exploitation
ID: 14187cda-57a1-5d8d-8043-922b303b98eb
STIX ID: report--14187cda-57a1-5d8d-8043-922b303b98eb
Feed Name: ThreatCluster
Threat Score
Multiple critical vulnerabilities in the Zammad ticketing system are reported: CVE-2026-102489 (session hijack that can lead to remote code execution affecting Zammad 6.3.0–6.5.4) and CVE-2026-102490 (local privilege escalation allowing the zammad user to obtain root on all versions, including latest alpha); Horizon3.ai warns these issues are trivial to reproduce and pose a significant exploitation risk.
Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.