# CVE-2026-102489: Zammad GmbH Zammad Session Fixation Vulnerability

- Exploited (CISA KEV): yes, added 2026-10-02
- Published: 2026-09-30
- CVSS: 8.7 HIGH (v4.0)
- EPSS: 22.5% (98th percentile)
- CWE: CWE-384

Zammad versions 6.3.0 to 6.5.4 are vulnerable a session hijack vulnerability that leads to remote code execution as the zammad user. The bug is also present in version 7.0.0 to version 7.1.2, but not exploitable due to changes in the underlying framework.

## Edge WAF coverage (claimed by vendors, not measured)

| Vendor | Status | First rule | Days after publication |
|---|---|---|---|
| Cloudflare | No public claim | — | — |
| AWS | No public claim | — | — |
| Microsoft Azure | No public claim | — | — |
| Google Cloud | No public claim | — | — |
| Fastly | Before feed history | — | — |
| F5 | Rule published | 2026-10-21 | 21 |
| Akamai | No public source | — | — |
| OWASP CRS | No public claim | — | — |

### F5

- 2026-10-21 · new · rule 200204111
  > Added: signature 200204111 "Zammad Remote Code Execution" (Server Side Code Injection, risk High), systems: Other Web Server. References: CVE-2026-102489.
  Source: https://docs.cloud.f5.com/docs-v2/platform/changelogs/security-details-changelog

"No public claim" means no vendor statement names this CVE; "Before feed history" means the CVE is older than the vendor feed. In both cases generic rules may still block it.

HTML: https://cve.vigilbase.com/cve/CVE-2026-102489 · JSON: https://cve.vigilbase.com/api/v1/cves/CVE-2026-102489