Exploiting Zammad CVE-2026-102489: Session Leak to Remote Code Execution

In a recent targeted cyberattack, threat actors exploited a critical vulnerability identified as CVE-2026-102489 within the Zammad ticketing system. This vulnerability allows attackers to leverage an unauthenticated WebSocket session leak into remote code execution (RCE) capabilities. The attack has been observed in multiple organizations utilizing Zammad, a popular open-source ticketing platform, primarily targeting mid-sized businesses due to their widespread adoption of this tool. The exploitation requires minimal initial access, making it attractive for adversaries seeking quick and pervasive entry points.

The attack utilized publicly accessible Zammad instances, abusing the session leak mechanics to hijack active session credentials. This provided attackers with the necessary authentication to progress further into executing malicious payloads on compromised systems. The implications of this are significant, as it compromises operational integrity and exposes sensitive user data to potential exfiltration.

How It Was Built

The exploitation chain of CVE-2026-102489 begins with identifying Zammad instances with WebSocket ports exposed. Attackers used automated scanning tools to detect these instances, identifying session cookie transmissions over WebSocket connections.


GET /ws/sessions HTTP/1.1

Host: target.zammad.domain

Upgrade: websocket

Connection: Upgrade

Sec-WebSocket-Key: dGhlIHNhbXBsZSBub25jZQ==

Sec-WebSocket-Version: 13

Session-Cookie: session_id:abcdefg1234567;

Once a valid session was identified, attackers could hijack it to impersonate the authenticated user. From here, they leveraged LFI (Local File Inclusion) vulnerabilities paired with the session access to upload and execute malicious Ruby scripts—leveraging the platform’s scripting capabilities designed for administrative automation.

The payload typically injected included commands for system reconnaissance and the installation of persistent backdoors, facilitating continuous access.

Why It Worked

Key to the success of this campaign was the use of WebSocket session hijacking. This method effectively bypassed the initial authentication stages that would typically deter unauthorized access. The simplicity and stealth of such an approach allowed attackers to operate under the radar of basic anomaly detection systems. Furthermore, by targeting Zammad’s scripting extension capabilities—intended for legitimate platform use—they effectively blended malicious operations within the platform’s expected behavior, sidestepping heuristic detection.

Another critical aspect was the focus on non-enterprise targets. By focusing on mid-sized businesses, attackers leveraged the limited security resources of these organizations, increasing the likelihood of successful exploitation unnoticed.

Operator Takeaways

For red teamers, this exploit provides an advantageous template: leveraging session management oversights combined with lateral exploitation via web application scripting. The initial foothold is gained with precision targeting, using open-source intelligence to identify vulnerable endpoints. Ensure to mimic comprehensive real-world reconnaissance operations, assessing publicly exposed WebSocket channels in potential target organizations. Additionally, focus on constructing payloads that exploit industry-specific tools or integrations to forge convincing execution paths.

Good / Better / Best

Good: Identifying exposed WebSocket endpoints on target networks.
Better: Using hijacked sessions to execute standard admin operations, thus bypassing traditional network defenses.
Best: Crafting payloads leveraging integrated application scripting capabilities for long-term persistence while appearing operationally legitimate.

References

For further information and technical details on this vulnerability and its exploitation, refer to the Horizon3 AI vulnerability disclosure.

Additional insights on alert patterns and forensic recovery can be gleaned from this research discussion on implementing mitigation strategies in open-source systems.