CVE-2026-102489

{
  "etk_id": "ETK-2026-141",
  "cve_id": "CVE-2026-102489",
  "display_id": "CVE-2026-102489",
  "ghsa_id": "GHSA-xmw5-m2wg-4243",
  "euvd_id": "EUVD-2026-90080",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Session hijacking leading to code execution in Zammad",
  "summary": "Zammad deployments in the affected 6.3.x through 6.5.x line are susceptible to session hijacking that can lead to code execution as the Zammad user. The advisory does not describe the attack prerequisites; it reports that the issue is not exploitable in the described 7.0.0 through 7.1.3 environments.",
  "mitigation": "Upgrade Zammad to version 6.5.4. Review active Zammad sessions and service-account activity for signs of unauthorized use while upgrading.",
  "vendor": "Zammad GmbH",
  "product": "Zammad",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 6.3.0, < 6.5.4"
      ],
      "ecosystem": null,
      "fixed_versions": [
        "6.5.4"
      ],
      "package_name": "Zammad",
      "purl": null
    }
  ],
  "cwes": null,
  "cvss_score": 9.4,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:A/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:X/V:C/RE:X/U:X",
  "epss_score": 0.0126,
  "epss_percentile": 0.691,
  "epss_asof": "2026-10-20",
  "automation": "deterministic",
  "check": true,
  "check_confidence_basis": "differential",
  "exploit": false,
  "pipeline_minutes": 41.85870576666667,
  "t0_at": "2026-09-30T16:21:19.937000+00:00",
  "signals": {
    "check": {
      "at": "2026-10-02T00:12:39.446360+00:00",
      "days": 1.3273091361111111,
      "is_lower_bound": false,
      "measured_at": "2026-09-30T16:21:19.937000+00:00",
      "url": null
    },
    "kev": {
      "at": "2026-09-30T00:00:00+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-09-30T16:21:19.937000+00:00",
      "precision": "day",
      "url": "https://euvd.enisa.europa.eu/enisa/EUVD-2026-90080"
    },
    "public_poc": {
      "at": "2026-10-06T19:00:36+00:00",
      "days": 6.110602581018519,
      "is_lower_bound": false,
      "measured_at": "2026-09-30T16:21:19.937000+00:00",
      "url": "https://github.com/horizon3ai/CVE-2026-102489"
    },
    "trigger_signal": {
      "at": "2026-09-30T16:21:19.937000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-09-30T16:21:19.937000+00:00",
      "url": "https://github.com/advisories/GHSA-xmw5-m2wg-4243"
    }
  }
}