Zammad CVE-2026-102489: From Session Leak to Remote Code Execution

Zammad, an open-source helpdesk and support ticket system, was thrust into the cybersecurity spotlight with the discovery of CVE-2026-102489, a vulnerability that allows attackers to escalate from a session leak to remote code execution (RCE). This particular CVE has gained attention due to its impact on sensitive customer support environments, often housing confidential data ranging from customer communications to internal workflows.

Campaign or TTP Overview

In the early months of 2026, security researchers unveiled a significant flaw in Zammad’s underlying WebSocket implementation. This flaw permits a malicious actor to intercept session cookies due to improper handling of WebSocket errors. The timeline of incidents spanned from late 2025, with increased exploitation observed in early 2026, primarily targeting companies utilizing Zammad for customer support operations.

The specific technique involves exploiting exposed WebSocket connections to capture user session data. Once attackers obtain these cookies, they can impersonate legitimate users, escalating privileges and potentially executing arbitrary code within the application environment. Industries heavily reliant on customer interaction platforms, such as tech support and online retail, composed the main threat landscape.

How It Was Built

Attackers crafted a sophisticated lure centered on customer interaction. The attack exploits a gap in session management and encryption during WebSocket connection setup under specific error conditions. Through a malformed packet injection into the WebSocket communication, attackers can provoke errors, coercing the platform into inadvertently divulging session cookies.


GET /ws/ HTTP/1.1

Host: vulnerable-zammad-instance.com

Upgrade: websocket

Connection: Upgrade

Sec-WebSocket-Key: dGhlIHNhbXBsZSBub25jZQ==

Sec-WebSocket-Version: 13

The above request is manipulated to tease out vulnerabilities in WebSocket handling, forming the attack’s technical backbone. Additionally, the attackers used generic yet credible emails to funnel users to maliciously crafted portals resembling genuine Zammad login pages. For instance, emails might bear subjects like “Immediate Action Required: Update Your Support Credentials” with links masked under recognizable domains.

Why It Worked

Several factors heightened the effectiveness of this exploit. Firstly, the seamless imitation of authentic Zammad communications was central. By employing lookalike domains and spoofed sender identities, attackers breached initial user skepticism. Secondly, leveraging the WebSocket protocol’s inherent complexities allowed for bypassing conventional web security mechanisms—victims were unguarded against such nuanced vectors.

The choice to prioritize WebSocket manipulation over conventional HTTP exploits proved beneficial. WebSockets, designed for persistent connections, provide an Achilles’ heel in many real-time applications when error handling is insufficiently stringent.

Operator Takeaways

As a red team operator, emulating the structure of this attack can provide invaluable testing insights. Focus on identifying potential session mismanagement across other WebSocket implementations within different platforms. Pay attention to web protocol exploitation over merely credential phishes—innovative vectors yield unexpected angles of attack.

Craft lures that integrate seamlessly into target workflows, working from an inside-out operational perspective. The cohesiveness of your false narrative greatly determines your success in phishing campaigns. Additionally, always map attack surfaces for obscure entry points like non-staple protocols.

Good / Better / Best

Good: Using known phishing templates for general engagement.

Better: Adapting each message to the role and responsibility of likely recipients within the organization.

Best: Creating highly tailored lures that mimic active support tickets or ongoing internal projects, increasing believability among domain professionals.

References

Horizon3 CVE-2026-102489 Disclosure

OWASP Top Ten