TLP:CLEARSECURITY ADVISORYHRK-SA-2026-1101-18Public PoC available
Zammad RCE (CVE-2026-102489): session hijacking that chains to code execution
A critical flaw in the Zammad help desk and ticketing platform enables session hijacking that chains to remote code execution, and a working proof-of-concept is public. A help desk holds customer data and agent sessions, so this is both a data-exposure and a foothold risk. Upgrade to the fixed release, then rotate sessions.
SEVERITY
Critical
PEAK CVSS
n/a
AUTH REQUIRED
Low
PUBLIC POC
Yes
PUBLISHED
Nov 1, 2026
REVISION
v1.0 · @Melly
Hayrok Research highlight
A help desk is a soft target with hard access: it holds customer records, it stores agent sessions, and support staff click links for a living. CVE-2026-102489 turns that into a problem.
The flaw lets an attacker hijack a Zammad session and chain it to remote code execution on the server. A public proof-of-concept is already available, which collapses the time between reading about it and seeing it used. An attacker who lands here reads tickets, impersonates agents, and runs code on the host that serves them.
Support platforms rarely get the scrutiny of the main application, yet they sit on the same network and often trust the same identity provider. That is exactly why they are worth an attacker's time. Patching the fixed release closes the flaw, but because sessions are the currency here, the second half of the job is rotating sessions and reviewing what an exposed instance could have touched.
01 · EXECUTIVE SUMMARY
Bottom line
Hayrok Research Lab is highlighting a critical flaw in the Zammad help desk and ticketing platform that enables session hijacking and chains to remote code execution. A public proof-of-concept exists, which shortens the window to exploitation. A support platform concentrates customer data and agent sessions and often sits on the internal network, so the response is to upgrade to the fixed release and rotate sessions and credentials the instance could reach.
KEY JUDGMENTS
01
A public proof-of-concept for CVE-2026-102489 has been released, demonstrating session hijacking that chains to remote code execution.Observed
02
A help desk holds customer records and agent sessions and is a frequent phishing and social-engineering target, so impact extends to data exposure and identity abuse.Assessed
03
Self-hosted Zammad instances on the internal network are the primary exposure, especially those reachable by customers or integrated with the corporate identity provider.Assessed
04
Because sessions are the exploited currency, patching alone is insufficient on an exposed instance: session rotation is part of remediation.Assessed
Zammad releases before the fixed version (confirm in the advisory)
Scoring
Rated critical by the project; confirm CVSS in the advisory
Public PoC
Yes
Impact
Session hijacking, agent impersonation, and remote code execution.
EXPOSURE: AN UNPATCHED HELP DESK
01Zammad below the fixA release before the fixed version.
02ReachableAgents or customers can reach the instance.
03Sessions in playActive agent sessions are the exploited currency.
04Trusted integrationsShared identity provider or internal network reach raises the stakes.
03 · THREAT ACTIVITY
Exploitation status and timeline
PUBLIC POCAvailableWorking PoC released.
IN THE WILDNot confirmedNo confirmed exploitation yet.
DATA AT RISKTickets, sessionsCustomer data and agent sessions.
PATCHAvailableFixed release from the project.
DISCLOSURE AND ACTIVITY TIMELINE · 2026
DisclosureZammad publishes a security advisory and fixed release for CVE-2026-102489.
Shortly afterA public proof-of-concept is released, enabling session hijacking that chains to remote code execution.
OngoingConfirm the running version and fixed release in the project's advisory, and treat exposed instances as possibly session-compromised.
04 · AFFECTED PRODUCTS
Affected and fixed versions
Confirm the exact affected range and fixed release against Zammad's own security advisory. The practical rule is to move to the fixed release and rotate sessions.
ITEM
AFFECTED
FIXED IN
STATUS
Zammad (self-hosted)
before the fixed release
fixed release per Zammad advisory
Fixed
Internet-facing instances
reachable by customers
patch and rotate sessions
Higher risk
Instances on the fixed release
not affected
keep current
Fixed
CONFIRM IN THE ADVISORYThe exact affected version range and the fixed release come from Zammad's own security advisory. Confirm them there, and record the fixed version you deployed.
05 · RECOMMENDED ACTIONS
What to do, in priority order
CriticalImmediately
Internet-facing or customer-reachable ZammadUpgrade to the fixed release now. A public PoC chains session hijack to code execution.
Exposed instancesRotate active agent sessions and any credentials the instance could reach.
HighWithin 72 hours
All self-hosted instancesUpgrade, including internal-only help desks.
Identity integrationsReview shared SSO or identity-provider trust so a help desk compromise does not spread.
Agent accountsReview agent and admin accounts for unexpected activity.
HighBefore closing
Every instanceRecord the fixed version, session rotation and any compromise review as evidence.
WORKAROUNDS
Upgrade to the fixed release. The fix. There is no durable configuration substitute.Restrict reachability. Limit who can reach the Zammad instance while you patch, especially from the internet.Rotate sessions. Invalidate active sessions after patching to defeat hijacked tokens.Review integrations. Tighten identity-provider trust so a help desk compromise does not pivot outward.
06 · DETECTION AND HUNTING
Observables and hunting queries
This is an application-layer flaw on a self-hosted service. Hunt on the running version, on anomalous sessions, and on unexpected processes on the host.
TYPE
OBSERVABLE
SOURCE
Exposure
A running Zammad version below the fixed release
Version endpoint, inventory
Behavior
Unexpected agent session activity or impersonation
CVE-2026-102489 is a critical flaw in the Zammad help desk platform that enables session hijacking and chains to remote code execution. The published proof-of-concept demonstrates taking over a session and escalating from that foothold to running code on the server. Because the exploit centers on sessions, an attacker who succeeds can act as a legitimate agent, read and modify tickets, and reach the data and integrations the instance trusts.
A help desk is an attractive target precisely because it is not the crown-jewel application and is often watched less closely, yet it holds customer records, correspondence, and agent credentials, and it frequently shares an identity provider with the rest of the business. Confirm the affected range and fixed release in Zammad's advisory, upgrade, and then rotate sessions, because a patched instance that was exposed may already have had sessions stolen.
01 REACH
Attacker reaches an unpatched Zammad instance
Control: Restrict reachability while patching
02 HIJACK
A session is hijacked
Control: Upgrade to the fixed release
03 ESCALATE
The session is chained to code execution
Control: Rotate sessions after patching
04 PIVOT
Ticket data read, agents impersonated, host reached
TeamCity RCE. Another self-hosted internal service where a foothold reaches broad trust.
AssessedSupport platforms carry crown-jewel data with second-tier scrutiny. A public PoC that chains session theft to code execution is exactly why they deserve first-tier patching.
09 · VALIDATION
Confirm remediation
A version bump is not a verdict after a session flaw. Each instance should end with evidence: the fixed release running, sessions rotated, and reachability controlled.
This advisory will be updated as exploitation activity or vendor guidance changes.
12 · FAQ
Is CVE-2026-102489 being exploited?
A public proof-of-concept has been released demonstrating session hijacking that chains to remote code execution. No confirmed in-the-wild exploitation at the time of writing; treat the PoC as imminent risk.
What can an attacker do?
Hijack an agent session, read and modify tickets, impersonate agents, and chain to code execution on the server.
How do we fix it?
Upgrade to the fixed Zammad release in the project's advisory, then rotate sessions and review agent activity on any exposed instance.
Is session rotation really necessary?
Yes. Because the flaw turns on sessions, a patched instance that was reachable while vulnerable may already have had sessions stolen.
VALIDATE YOUR EXPOSURE
Prove your support-platform exposure
Hayrok inventories your self-hosted support and ticketing tools, reads the running version, checks reachability, and tests whether an exposed instance could leak sessions. Every result lands in Evidence Fabric.