CriticalZero-DayCVE-2026-102489
PoC Released for Zammad Session Leak Flaw Enabling Remote Code Execution
Cyber Security News·Source published ·1 min read
What happened?
A public PoC targets a critical Zammad flaw, CVE-2026-102489, allowing unauthenticated remote users to steal active session cookies and potentially execute code on vulnerable servers. The issue was associated with a breach reported in September at the Dutch Institute for Vulnerability Disclosure (DIVD), where two zero-day flaws in Zammad were reportedly exploited to gain access and escalate privileges.
Key details
- A public proof‑of‑concept demonstrates a critical Zammad flaw that lets unauthenticated attackers steal active session cookies and possibly run code.
- Exploitation uses a request to the /ws endpoint with a {"event":"base"} payload, causing an error that leaks internal WebSocket data.
- The attack only works when at least one authenticated user is connected to the WebSocket endpoint at the time of exploitation.
- DIVD discovered unusual activity on September 22 after an intrusion on September 21, linking the breach to two zero‑day Zammad vulnerabilities.
- Administrators are urged to upgrade to Zammad version 7 immediately or isolate affected systems, and a script is available to detect leaked cookies.
What to look for
- Detection of unusual activity on September 22 suggests a possible breach related to the Zammad flaws.
- Presence of leaked _zammad_session cookies in server logs indicates exploitation of the WebSocket leak.
- Malicious files written to the Zammad application directory via the package installation feature.
- Email templates replaced with harmful ERB code, enabling remote code execution under the Zammad service account, though not as root.
Summarised by SecOraLens from Cyber Security News. Always read the original source before acting. How SecOraLens verifies advisories.