BugRater
Early access. The directory is still filling out, and every rating here comes from a researcher's reported experience.

Security releases

Zammad GmbH

Zammad GmbH Security Releases - September 2026

zammad-gmbh-2026-09 Sep 1, 2026 Source: Vendor

Zammad GmbH security advisories for September 2026, compiled from CVE.org records.

Source of record The credited names below are quoted verbatim from the vendor's own advisory: https://www.cve.org/CVERecord?id=CVE-2026-102489
Are you credited here? Sign in to claim your line. It is yours immediately, with no review queue. The name the vendor printed stays next to your handle for anyone to check against the advisory above, and any member who thinks a claim is wrong can refute it.

Credited

10 lines
All 10 CVEs 10 Additional recognition 0 Unclaimed only
Showing 1–10 of 10
CVE-2026-102489 Known exploited (CISA KEV) BR2026-0000-039692 Zammad unclaimed
Zammad versions 6.3.0 to 6.5.4 are vulnerable a session hijack vulnerability that leads to remote code execution as the zammad user. The bug is also present in version 7.0.0 to version 7.1.2, but n...
Credited as Earth Grob (Merlon Security)
CVE-2026-102489 Known exploited (CISA KEV) BR2026-0000-039693 Zammad unclaimed
Zammad versions 6.3.0 to 6.5.4 are vulnerable a session hijack vulnerability that leads to remote code execution as the zammad user. The bug is also present in version 7.0.0 to version 7.1.2, but n...
Credited as Luke Paris (Merlon Security)
CVE-2026-102489 Known exploited (CISA KEV) BR2026-0000-039694 Zammad unclaimed
Zammad versions 6.3.0 to 6.5.4 are vulnerable a session hijack vulnerability that leads to remote code execution as the zammad user. The bug is also present in version 7.0.0 to version 7.1.2, but n...
Credited as Tijmen van der Spijk (Merlon Security)
CVE-2026-102489 Known exploited (CISA KEV) BR2026-0000-039695 Zammad unclaimed
Zammad versions 6.3.0 to 6.5.4 are vulnerable a session hijack vulnerability that leads to remote code execution as the zammad user. The bug is also present in version 7.0.0 to version 7.1.2, but n...
Credited as Zohar Cochavi (Merlon Security)
CVE-2026-102489 Known exploited (CISA KEV) BR2026-0000-039696 Zammad unclaimed
Zammad versions 6.3.0 to 6.5.4 are vulnerable a session hijack vulnerability that leads to remote code execution as the zammad user. The bug is also present in version 7.0.0 to version 7.1.2, but n...
Credited as Alje Woltjer (Merlon Security)
CVE-2026-102489 Known exploited (CISA KEV) BR2026-0000-039697 Zammad unclaimed
Zammad versions 6.3.0 to 6.5.4 are vulnerable a session hijack vulnerability that leads to remote code execution as the zammad user. The bug is also present in version 7.0.0 to version 7.1.2, but n...
Credited as Mischa Rick van Geelen (DIVD)
CVE-2026-102489 Known exploited (CISA KEV) BR2026-0000-039698 Zammad unclaimed
Zammad versions 6.3.0 to 6.5.4 are vulnerable a session hijack vulnerability that leads to remote code execution as the zammad user. The bug is also present in version 7.0.0 to version 7.1.2, but n...
Credited as Ralph Horn (DIVD)
CVE-2026-102489 Known exploited (CISA KEV) BR2026-0000-039699 Zammad unclaimed
Zammad versions 6.3.0 to 6.5.4 are vulnerable a session hijack vulnerability that leads to remote code execution as the zammad user. The bug is also present in version 7.0.0 to version 7.1.2, but n...
Credited as Max van der Horst (DIVD)
CVE-2026-102489 Known exploited (CISA KEV) BR2026-0000-039700 Zammad unclaimed
Zammad versions 6.3.0 to 6.5.4 are vulnerable a session hijack vulnerability that leads to remote code execution as the zammad user. The bug is also present in version 7.0.0 to version 7.1.2, but n...
Credited as Victor Pasman (DIVD)
CVE-2026-102489 Known exploited (CISA KEV) BR2026-0000-039701 Zammad unclaimed
Zammad versions 6.3.0 to 6.5.4 are vulnerable a session hijack vulnerability that leads to remote code execution as the zammad user. The bug is also present in version 7.0.0 to version 7.1.2, but n...
Credited as Frank Breedijk (DIVD)