Critical Zammad RCE Flaw CVE-2023-44606 Gets Proof-of-Concept Exploit

Key Takeaways

• A critical Zammad vulnerability (CVE-2026-102489) has a public proof-of-concept (PoC) exploit.
• The flaw allows unauthenticated attackers to steal active user session cookies, potentially leading to remote code execution (RCE).
• Zammad versions 6.3.0 through 6.5.4 are vulnerable to exploitation, while versions 7.0.0 through 7.1.3 contain the underlying code issue but are not exploitable under current conditions.
• The vulnerability was linked to a September breach at the Dutch Institute for Vulnerability Disclosure (DIVD), where it was reportedly exploited as a zero-day.
• Immediate patching to Zammad version 7 or higher is strongly recommended.

A significant security alert has been issued for Zammad, a popular open-source helpdesk system, following the public release of a proof-of-concept (PoC) exploit for a critical remote code execution (RCE) vulnerability, identified as CVE-2026-102489. This flaw allows unauthenticated attackers to hijack user sessions and potentially execute arbitrary code on vulnerable servers.

The vulnerability gained prominence after its reported exploitation in a September breach at the Dutch Institute for Vulnerability Disclosure (DIVD). In that incident, two zero-day flaws in Zammad were leveraged to gain initial access and escalate privileges.

Affected Versions and Exploitation Conditions

The critical vulnerability impacts Zammad versions 6.3.0 through 6.5.4, making them susceptible to remote exploitation. Interestingly, while Zammad versions 7.0.0 through 7.1.3 contain the same underlying code defect, DIVD noted that they lack the necessary environmental conditions for successful exploitation.

The PoC demonstrated by Horizon3.ai shows how the flaw exploits a WebSocket information leak, which can lead directly to session hijacking and remote code execution with the privileges of a low-privileged Zammad operating system user.

Mechanism of the Session Leak

The core of this vulnerability resides within Zammad’s WebSocket event handling mechanism. Researchers discovered that by sending a specific request to the /ws endpoint with the payload {"event":"base"}, an application error could be triggered. Rather than returning a benign error, the server’s response might inadvertently expose internal data tied to active WebSocket connections.

This leaked information can include crucial _zammad_session cookies belonging to users currently logged into the application. A session cookie is akin to a temporary authentication token, granting access to an authenticated session without requiring a password or multi-factor authentication. The vulnerability specifically arises from how Zammad handles live connection data stored in its @clients object, which includes sensitive request headers like the Cookie header. When an error occurs during event processing, the code can return an object that inadvertently reveals these sensitive values to the requesting party.

Escalation to Remote Code Execution

The implications of this session leak are particularly severe if an administrator’s session cookie is compromised. Horizon3.ai’s PoC illustrates that an attacker who successfully hijacks an administrative session can leverage Zammad’s package installation feature. This allows the attacker to write malicious files into the application directory, effectively replacing legitimate email templates with malicious ERB code. This mechanism facilitates remote code execution under the context of the Zammad service account, though not as the root user.

For the exploit to be effective, at least one authenticated user must be actively connected to the WebSocket endpoint at the time of the attack. This condition makes publicly accessible Zammad servers especially vulnerable, necessitating immediate attention. Helpdesk systems frequently store highly sensitive data, including customer details, support conversations, and internal operational information, making them prime targets for malicious actors.

Historical Context and Mitigation

The breach at DIVD, which surfaced on September 22 following an intrusion on September 21, was directly attributed to two zero-day Zammad vulnerabilities. The first, CVE-2026-102489, is the session hijacking and RCE flaw now with a public PoC. The second, CVE-2026-102490, is a local privilege escalation vulnerability that could allow the Zammad user to gain root access. Technical details for CVE-2026-102490 remain undisclosed, as it was reportedly unpatched at the time of the DIVD incident.

What You Should Do

• Update Immediately: Zammad administrators should urgently update their installations to version 7 or later to patch CVE-2026-102489. If immediate patching is not feasible, consider taking affected systems offline.
• Review Logs: Utilize the script released by DIVD to identify potential evidence of leaked session cookies in Zammad logs.
• Preserve Evidence: Given the possibility of prior exploitation as a zero-day, preserve all system logs before applying any patches or making system changes.
• Assess Past Exposure: Beyond patching, conduct a thorough assessment of previous exposure to determine if your systems were compromised before public disclosure.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.