Exploiting CVE-2026-102489 and CVE-2026-102490 in Zammad: A Case of Session Fixation and Privilege Escalation

Zammad, an open-source helpdesk and ticketing platform, became the focus of a highly technical exploitation campaign that leveraged two critical vulnerabilities: CVE-2026-102489 and CVE-2026-102490. Detected in early 2026, this campaign specifically targeted organizations utilizing Zammad for their customer service operations, aiming to compromise data integrity and privacy. By chaining a session fixation vulnerability with improper privilege management, cyber adversaries were able to achieve both remote code execution and unauthorized privilege escalation.

The exploitation mechanics were meticulously crafted, with initial observations documented by various security analysts and susceptibility noted in Zammad instances. This campaign underscored an urgent need for understanding and addressing security hygiene for open-source platforms. More details and tracking of this campaign can be found at the CISA’s Known Exploited Vulnerabilities Catalog.

How It Was Built

The attack on Zammad leveraged two distinct vulnerabilities in tandem. First, CVE-2026-102489 involved session fixation, a flaw that allowed an attacker to fixate a session ID before a user continued with authentication. The malicious actor could then hijack an authenticated session of the victim. Second, CVE-2026-102490 exploited improper privilege checks which enabled the attacker to escalate their privileges within the compromised Zammad instance.

The campaign generally followed this delivery mechanism:

An email was sent to the target, masquerading as legitimate platform communication. The email subject usually read something like: “Action Required: Security Update for Zammad Account”.
The email contained a URL resembling a genuine link, such as: http://zammad.support-login.com/update.
The link led to a mock login page indistinguishable from the actual Zammad portal, designed to capture session IDs and initiate a session fixation.


GET /login?next=/ HTTP/1.1

Host: zammad.support-login.com

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64)

Accept: text/html,application/xhtml+xml

Accept-Language: en-US,en;q=0.5

Cookie: authToken=abc123sessiontoken

After obtaining the session token, attackers utilized improper privilege escalation mechanisms to gain administrative controls over the Zammad instance, paving the way for remote code execution.

Why It Worked

The effectiveness of this campaign was rooted in several calculated choices:

Session Fixation Understanding: By exploiting CVE-2026-102489, attackers could maintain control over the session even after the victim authenticated, crucial for seamless attack continuity.
Domain Mimicry: The use of a domain pattern that closely mirrored the legitimate Zammad site increased the likelihood of victims clicking without suspicion. The URL pattern (http://zammad.support-login.com) played a pivotal role in crafting the illusion of legitimacy.
Lure Design: The email’s subject and branding were aligned with security updates, leveraging social engineering to prompt rapid, thoughtless action by the recipient.

Acting quickly on perceived security notifications often leads recipients to bypass critical analysis, opening paths for attacker exploitations.

Operator Takeaways

For red teamers aiming to replicate or learn from this campaign, the following elements are key:

Domain Crafting: Craft domain names that closely resemble legitimate services without triggering obvious suspicion. Domain registration costs are minimal compared to the potential impact.
Session Management Exploits: Gain an in-depth understanding of session fixation vulnerabilities and how maintaining session control can facilitate further escalations.
Brand Consistency in Lures: Ensure that all email correspondence reflects the victim organization’s genuine communication style, enhancing credibility.

Good / Better / Best

Good: Establishing basic domain mimicry techniques for phishing. Use homographs and similar name structures to blend in.

Better: Integrate more sophisticated session handling mechanisms that allow you to not only predict, but also pre-set session expectations, such as those mimicking legitimate session continuation processes.

Best: Fully develop an end-to-end exploitation chain—from initial session fixation to full privilege escalation and remote code execution—ensuring seamless transitions between steps with minimal user awareness.

References

CISA’s Known Exploited Vulnerabilities Catalog