Vulnerability
A Zammad helpdesk vulnerability allowing an unauthenticated attacker to leak active users' session cookies via the /ws endpoint's Ruby error output.
CISA added Zammad's unauthenticated WebSocket session-disclosure flaw, CVE-2026-102489, to its exploited-vulnerabilities catalog on October 2. The fix ships in Zammad 7.2.0, leaving teams on the unsupported 6.5-and-earlier releases to make a major-version jump.
Reality
Horizon3 reproduced CVE-2026-102489 and showed one unauthenticated request to Zammad's /ws endpoint reflects every active user's session cookie. A leaked admin cookie opens the second half of the chain, remote code execution.
Reality
DIVD, the Dutch volunteer disclosure group, was breached through two chained zero-days in its own Zammad helpdesk that took an attacker to root in seconds. Zammad claims over 2,000 customers, and DIVD wants every older install upgraded to version 7 or taken offline.
Perspective Coverage
9 publishersReality
DIVD says an attacker chained two unpublished Zammad bugs from an unauthenticated web session to root on its helpdesk host. Its claim that an autonomous AI agent did it is still a first-party assessment with no independent confirmation yet.
Reality
DIVD said attackers chained two Zammad zero-days on its own internet-facing server and went from a hijacked session to root in seconds. It assessed that an AI agent was involved and says upgrading to version 7 is not a complete fix for both flaws.
Reality