PoC Exploit Released for Zammad Vulnerability Enabling Session Hijacking and Remote Code Execution

A public proof-of-concept exploit for Zammad CVE-2026-102489 was published, allowing an unauthenticated attacker to trigger a WebSocket error that leaks connected clients' HTTP cookie headers and valid_zammad_session values; if a privileged session is hijacked the attacker can install an ERB template to achieve remote code execution as the Zammad OS user. The vulnerability was reportedly used alongside a local privilege escalation (CVE-2026-102490) in an intrusion against DIVD that may have exposed volunteer contact data, and the availability of functional exploit code substantially raises the urgency for patching and mitigation.