[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"repo-stars":3,"vuln-CVE-2026-102489":6},{"stargazers_count":4,"fetched_at":5},8,"2026-10-02T17:25:24.142Z",{"id":7,"descriptions":8,"cisa":9,"weaknesses":10,"exploits":468,"aliases":469,"duplicate_of":9,"upstream":470,"downstream":471,"duplicates":472,"related":473,"reserved_at":9,"published_at":474,"modified_at":475,"state":476,"summary":477,"references_raw":488,"kevs":505,"epss":516,"epss_history":518,"metrics":524,"affected":537},"CVE-2026-102489","Zammad versions 6.3.0 to 6.5.4 are vulnerable a session hijack vulnerability that leads to remote code execution as the zammad user. The vulnerability is also present in version 7.0.0 to version 7.1.3, but not exploitable due to environment conditions.",null,[11],{"_key":12,"id":12,"name":13,"description":14,"type":15,"status":16,"abstraction":17,"likelihood_of_exploit":9,"capec":18},"CWE-384","Session Fixation","Authenticating a user, or otherwise establishing a new user session, without invalidating any existing session identifier gives an attacker the opportunity to steal authenticated sessions.","weakness","Incomplete","Compound",[19,159,292,318,322,326,465],{"id":20,"name":21,"techniques":22},"CAPEC-196","Session Credential Falsification through Forging",[23,95,133],{"id":24,"name":25,"tactics":26,"countermeasures":36},"T1134.002","Create Process with Token",[27,30,33],{"id":28,"name":29},"TA0030","Defense Evasion",{"id":31,"name":32},"TA0005","Stealth",{"id":34,"name":35},"TA0111","Privilege Escalation",[37,42,47,52,57,61,65,69,73,77,82,87,91],{"id":38,"name":39,"tactic":40},"D3-AEM","Application Exception Monitoring",{"name":41},"Detect",{"id":43,"name":44,"tactic":45},"D3-RIC","Reissue Credential",{"name":46},"Restore",{"id":48,"name":49,"tactic":50},"D3-CH","Credential Hardening",{"name":51},"Harden",{"id":53,"name":54,"tactic":55},"D3-CR","Credential Revocation",{"name":56},"Evict",{"id":58,"name":59,"tactic":60},"D3-MFA","Multi-factor Authentication",{"name":51},{"id":62,"name":63,"tactic":64},"D3-CCSA","Credential Compromise Scope Analysis",{"name":41},{"id":66,"name":67,"tactic":68},"D3-OPM","Operational Process Monitoring",{"name":41},{"id":70,"name":71,"tactic":72},"D3-CRO","Credential Rotation",{"name":51},{"id":74,"name":75,"tactic":76},"D3-ANCI","Authentication Cache Invalidation",{"name":56},{"id":78,"name":79,"tactic":80},"D3-CTS","Credential Transmission Scoping",{"name":81},"Isolate",{"id":83,"name":84,"tactic":85},"D3-DUC","Decoy User Credential",{"name":86},"Deceive",{"id":88,"name":89,"tactic":90},"D3-TB","Token Binding",{"name":51},{"id":92,"name":93,"tactic":94},"D3-TBA","Token-based Authentication",{"name":51},{"id":96,"name":97,"tactics":98,"countermeasures":102},"T1134.003","Make and Impersonate Token",[99,100,101],{"id":28,"name":29},{"id":31,"name":32},{"id":34,"name":35},[103,105,107,111,113,115,117,119,121,123,125,127,129,131],{"id":58,"name":59,"tactic":104},{"name":51},{"id":43,"name":44,"tactic":106},{"name":46},{"id":108,"name":109,"tactic":110},"D3-ST","Session Termination",{"name":56},{"id":38,"name":39,"tactic":112},{"name":41},{"id":66,"name":67,"tactic":114},{"name":41},{"id":88,"name":89,"tactic":116},{"name":51},{"id":92,"name":93,"tactic":118},{"name":51},{"id":74,"name":75,"tactic":120},{"name":56},{"id":53,"name":54,"tactic":122},{"name":56},{"id":83,"name":84,"tactic":124},{"name":86},{"id":78,"name":79,"tactic":126},{"name":81},{"id":48,"name":49,"tactic":128},{"name":51},{"id":70,"name":71,"tactic":130},{"name":51},{"id":62,"name":63,"tactic":132},{"name":41},{"id":134,"name":135,"tactics":136,"countermeasures":140},"T1606","Forge Web Credentials",[137],{"id":138,"name":139},"TA0031","Credential Access",[141,143,145,147,149,151,153,155,157],{"id":48,"name":49,"tactic":142},{"name":51},{"id":74,"name":75,"tactic":144},{"name":56},{"id":70,"name":71,"tactic":146},{"name":51},{"id":58,"name":59,"tactic":148},{"name":51},{"id":83,"name":84,"tactic":150},{"name":86},{"id":53,"name":54,"tactic":152},{"name":56},{"id":62,"name":63,"tactic":154},{"name":41},{"id":43,"name":44,"tactic":156},{"name":46},{"id":78,"name":79,"tactic":158},{"name":81},{"id":160,"name":161,"techniques":162},"CAPEC-21","Exploitation of Trusted Identifiers",[163,240,268],{"id":164,"name":165,"tactics":166,"countermeasures":170},"T1134","Access Token Manipulation",[167,168,169],{"id":28,"name":29},{"id":31,"name":32},{"id":34,"name":35},[171,173,175,177,181,183,188,190,192,194,198,200,202,204,208,210,212,216,218,220,224,228,232,236],{"id":78,"name":79,"tactic":172},{"name":81},{"id":62,"name":63,"tactic":174},{"name":41},{"id":66,"name":67,"tactic":176},{"name":41},{"id":178,"name":179,"tactic":180},"D3-PSA","Process Spawn Analysis",{"name":41},{"id":108,"name":109,"tactic":182},{"name":56},{"id":184,"name":185,"tactic":186},"D3-NTPM","Network Traffic Policy Mapping",{"name":187},"Model",{"id":53,"name":54,"tactic":189},{"name":56},{"id":74,"name":75,"tactic":191},{"name":56},{"id":83,"name":84,"tactic":193},{"name":86},{"id":195,"name":196,"tactic":197},"D3-AM","Access Modeling",{"name":187},{"id":48,"name":49,"tactic":199},{"name":51},{"id":58,"name":59,"tactic":201},{"name":51},{"id":70,"name":71,"tactic":203},{"name":51},{"id":205,"name":206,"tactic":207},"D3-HBPI","Hardware-based Process Isolation",{"name":81},{"id":88,"name":89,"tactic":209},{"name":51},{"id":92,"name":93,"tactic":211},{"name":51},{"id":213,"name":214,"tactic":215},"D3-RC","Restore Configuration",{"name":46},{"id":38,"name":39,"tactic":217},{"name":41},{"id":43,"name":44,"tactic":219},{"name":46},{"id":221,"name":222,"tactic":223},"D3-CI","Configuration Inventory",{"name":187},{"id":225,"name":226,"tactic":227},"D3-SCA","System Call Analysis",{"name":41},{"id":229,"name":230,"tactic":231},"D3-SCF","System Call Filtering",{"name":81},{"id":233,"name":234,"tactic":235},"D3-EAL","Executable Allowlisting",{"name":81},{"id":237,"name":238,"tactic":239},"D3-EDL","Executable Denylisting",{"name":81},{"id":241,"name":242,"tactics":243,"countermeasures":245},"T1528","Steal Application Access Token",[244],{"id":138,"name":139},[246,248,250,252,254,256,258,260,262,264,266],{"id":48,"name":49,"tactic":247},{"name":51},{"id":43,"name":44,"tactic":249},{"name":46},{"id":74,"name":75,"tactic":251},{"name":56},{"id":88,"name":89,"tactic":253},{"name":51},{"id":78,"name":79,"tactic":255},{"name":81},{"id":58,"name":59,"tactic":257},{"name":51},{"id":53,"name":54,"tactic":259},{"name":56},{"id":92,"name":93,"tactic":261},{"name":51},{"id":62,"name":63,"tactic":263},{"name":41},{"id":70,"name":71,"tactic":265},{"name":51},{"id":83,"name":84,"tactic":267},{"name":86},{"id":269,"name":270,"tactics":271,"countermeasures":273},"T1539","Steal Web Session Cookie",[272],{"id":138,"name":139},[274,276,278,280,282,284,286,288,290],{"id":78,"name":79,"tactic":275},{"name":81},{"id":83,"name":84,"tactic":277},{"name":86},{"id":48,"name":49,"tactic":279},{"name":51},{"id":58,"name":59,"tactic":281},{"name":51},{"id":74,"name":75,"tactic":283},{"name":56},{"id":62,"name":63,"tactic":285},{"name":41},{"id":70,"name":71,"tactic":287},{"name":51},{"id":53,"name":54,"tactic":289},{"name":56},{"id":43,"name":44,"tactic":291},{"name":46},{"id":293,"name":294,"techniques":295},"CAPEC-31","Accessing/Intercepting/Modifying HTTP Cookies",[296],{"id":269,"name":270,"tactics":297,"countermeasures":299},[298],{"id":138,"name":139},[300,302,304,306,308,310,312,314,316],{"id":78,"name":79,"tactic":301},{"name":81},{"id":83,"name":84,"tactic":303},{"name":86},{"id":48,"name":49,"tactic":305},{"name":51},{"id":58,"name":59,"tactic":307},{"name":51},{"id":74,"name":75,"tactic":309},{"name":56},{"id":62,"name":63,"tactic":311},{"name":41},{"id":70,"name":71,"tactic":313},{"name":51},{"id":53,"name":54,"tactic":315},{"name":56},{"id":43,"name":44,"tactic":317},{"name":46},{"id":319,"name":320,"techniques":321},"CAPEC-39","Manipulating Opaque Client-based Data Tokens",[],{"id":323,"name":324,"techniques":325},"CAPEC-59","Session Credential Falsification through Prediction",[],{"id":327,"name":328,"techniques":329},"CAPEC-60","Reusing Session IDs (aka Session Replay)",[330,360],{"id":331,"name":332,"tactics":333,"countermeasures":337},"T1134.001","Token Impersonation/Theft",[334,335,336],{"id":28,"name":29},{"id":31,"name":32},{"id":34,"name":35},[338,340,342,344,346,348,350,352,354,356,358],{"id":53,"name":54,"tactic":339},{"name":56},{"id":62,"name":63,"tactic":341},{"name":41},{"id":78,"name":79,"tactic":343},{"name":81},{"id":74,"name":75,"tactic":345},{"name":56},{"id":88,"name":89,"tactic":347},{"name":51},{"id":92,"name":93,"tactic":349},{"name":51},{"id":83,"name":84,"tactic":351},{"name":86},{"id":48,"name":49,"tactic":353},{"name":51},{"id":70,"name":71,"tactic":355},{"name":51},{"id":58,"name":59,"tactic":357},{"name":51},{"id":43,"name":44,"tactic":359},{"name":46},{"id":361,"name":362,"tactics":363,"countermeasures":368},"T1550.004","Web Session Cookie",[364,365],{"id":28,"name":29},{"id":366,"name":367},"TA0109","Lateral Movement",[369,371,373,375,377,381,385,389,393,395,397,401,405,409,413,415,419,421,425,427,431,435,437,439,443,447,451,453,457,461],{"id":70,"name":71,"tactic":370},{"name":51},{"id":229,"name":230,"tactic":372},{"name":81},{"id":43,"name":44,"tactic":374},{"name":46},{"id":78,"name":79,"tactic":376},{"name":81},{"id":378,"name":379,"tactic":380},"D3-PHDURA","Per Host Download-Upload Ratio Analysis",{"name":41},{"id":382,"name":383,"tactic":384},"D3-APCA","Application Protocol Command Analysis",{"name":41},{"id":386,"name":387,"tactic":388},"D3-PSMD","Process Self-Modification Detection",{"name":41},{"id":390,"name":391,"tactic":392},"D3-RTSD","Remote Terminal Session Detection",{"name":41},{"id":178,"name":179,"tactic":394},{"name":41},{"id":205,"name":206,"tactic":396},{"name":81},{"id":398,"name":399,"tactic":400},"D3-KBPI","Kernel-based Process Isolation",{"name":81},{"id":402,"name":403,"tactic":404},"D3-ABPI","Application-based Process Isolation",{"name":81},{"id":406,"name":407,"tactic":408},"D3-HS","Host Shutdown",{"name":56},{"id":410,"name":411,"tactic":412},"D3-PMAD","Protocol Metadata Anomaly Detection",{"name":41},{"id":53,"name":54,"tactic":414},{"name":56},{"id":416,"name":417,"tactic":418},"D3-HR","Host Reboot",{"name":56},{"id":62,"name":63,"tactic":420},{"name":41},{"id":422,"name":423,"tactic":424},"D3-NTF","Network Traffic Filtering",{"name":81},{"id":83,"name":84,"tactic":426},{"name":86},{"id":428,"name":429,"tactic":430},"D3-CSPP","Client-server Payload Profiling",{"name":41},{"id":432,"name":433,"tactic":434},"D3-PT","Process Termination",{"name":56},{"id":48,"name":49,"tactic":436},{"name":51},{"id":58,"name":59,"tactic":438},{"name":51},{"id":440,"name":441,"tactic":442},"D3-PLA","Process Lineage Analysis",{"name":41},{"id":444,"name":445,"tactic":446},"D3-NTCD","Network Traffic Community Deviation",{"name":41},{"id":448,"name":449,"tactic":450},"D3-PS","Process Suspension",{"name":56},{"id":74,"name":75,"tactic":452},{"name":56},{"id":454,"name":455,"tactic":456},"D3-NTSA","Network Traffic Signature Analysis",{"name":41},{"id":458,"name":459,"tactic":460},"D3-WSAM","Web Session Access Mediation",{"name":81},{"id":462,"name":463,"tactic":464},"D3-UGLPA","User Geolocation Logon Pattern Analysis",{"name":41},{"id":466,"name":13,"techniques":467},"CAPEC-61",[],[],[],[],[],[],[],"2026-09-30T16:21:19.937Z","2026-10-02T19:58:24.036Z","Analyzed",{"cisa_kev":478,"cisa_ransomware":479,"cisa_vendor":480,"epss_severity":481,"epss_score":482,"severity":483,"severity_score":484,"severity_version":485,"severity_source":486,"severity_vector":487,"severity_status":476},true,false,"Zammad GmbH","low",0.00582,"critical",9.8,"v3.1","nvd","CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",[489,495,499],{"url":490,"sources":491,"tags":493},"https://csirt.divd.nl/DIVD-2026-00015",[492,486],"cve.org",[494],"Third Party Advisory",{"url":496,"sources":497,"tags":498},"https://csirt.divd.nl/CVE-2026-102489",[492,486],[494],{"url":500,"sources":501,"tags":502},"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-102489",[492,486],[503,504],"Government Resource","US Government Resource",[506],{"source":507,"vendor":480,"product":508,"date_added":509,"vulnerability_name":510,"short_description":511,"required_action":512,"due_date":513,"known_ransomware_campaign_use":514,"notes":515,"exploitation_type":9},"cisa","Zammad","2026-10-02","Zammad GmbH Zammad Session Fixation Vulnerability","Zammad GmbH Zammad contains a session fixation vulnerability that can lead to remote code execution as the zammad user. This vulnerability can be chained with CVE-2026-102490.","Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","2026-10-05","Unknown","https://zammad.com/en/product/releases/ ; https://community.zammad.org/t/take-care-local-privilege-escalation-cve-2026-102490-is-reported-as-being-actively-exploited/21297/2 ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-102489",{"date":509,"score":482,"percentile":517},0.45835,[519,523],{"date":520,"score":521,"percentile":522},"2026-10-01",0.00709,0.51763,{"date":509,"score":482,"percentile":517},[525,530],{"source":492,"cvss_v2_0":9,"cvss_v3_0":9,"cvss_v3_1":9,"cvss_v4_0":526},{"baseScore":527,"baseSeverity":528,"vectorString":529,"impactScore":9,"exploitabilityScore":9},8.7,"HIGH","CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:A/AU:Y/V:C",{"source":486,"cvss_v2_0":9,"cvss_v3_0":9,"cvss_v3_1":531,"cvss_v4_0":534},{"baseScore":484,"baseSeverity":532,"vectorString":487,"impactScore":484,"exploitabilityScore":533},"CRITICAL",10,{"baseScore":535,"baseSeverity":532,"vectorString":536,"impactScore":9,"exploitabilityScore":9},9.4,"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:A/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:X/V:C/RE:X/U:X",[538,549],{"ecosystem":9,"name":508,"vendor":539,"product":540,"cpe_part":541,"purl_type":9,"purl_namespace":9,"purl_name":9,"source":9,"versions":542},"zammad gmbh","zammad","a",[543],{"version":544,"is_range":478,"range_type":492,"version_start":545,"version_start_type":546,"version_end":547,"version_end_type":548,"fixed_in":9},">= 6.3.0, \u003C 6.5.4","6.3.0","including","6.5.4","excluding",{"ecosystem":9,"name":540,"vendor":540,"product":540,"cpe_part":541,"purl_type":9,"purl_namespace":9,"purl_name":9,"source":9,"versions":550},[551,554],{"version":552,"is_range":478,"range_type":553,"version_start":545,"version_start_type":546,"version_end":547,"version_end_type":548,"fixed_in":9},"gte6.3.0_lt6.5.4","cpe",{"version":555,"is_range":478,"range_type":553,"version_start":556,"version_start_type":546,"version_end":557,"version_end_type":546,"fixed_in":9},"gte7.0.0_lte7.1.3","7.0.0","7.1.3"]