{"schema":"vulnpedia.research/1","cve":"CVE-2026-102489","generated":"2026-10-26T13:52:32.101Z","references":[{"url":"https://csirt.divd.nl/DIVD-2026-00015","tags":["third-party-advisory","Third Party Advisory"],"source":"mitre","sourceId":"DIVD","modified":"2026-10-19T09:10:59.656Z","origins":[{"source":"mitre","sourceId":"DIVD","modified":"2026-10-19T09:10:59.656Z","url":"https://csirt.divd.nl/DIVD-2026-00015"},{"source":"nvd","sourceId":"CVE-2026-102489","modified":"2026-10-10T04:18:08.040","url":"https://csirt.divd.nl/DIVD-2026-00015"}]},{"url":"https://csirt.divd.nl/CVE-2026-102489","tags":["third-party-advisory","Third Party Advisory"],"source":"mitre","sourceId":"DIVD","modified":"2026-10-19T09:10:59.656Z","origins":[{"source":"mitre","sourceId":"DIVD","modified":"2026-10-19T09:10:59.656Z","url":"https://csirt.divd.nl/CVE-2026-102489"},{"source":"nvd","sourceId":"CVE-2026-102489","modified":"2026-10-10T04:18:08.040","url":"https://csirt.divd.nl/CVE-2026-102489"}]},{"url":"https://zammad.com/en/advisories/cve-2026-102489-cve-2026-102490","tags":["vendor-advisory","Vendor Advisory"],"source":"mitre","sourceId":"DIVD","modified":"2026-10-19T09:10:59.656Z","origins":[{"source":"mitre","sourceId":"DIVD","modified":"2026-10-19T09:10:59.656Z","url":"https://zammad.com/en/advisories/cve-2026-102489-cve-2026-102490"},{"source":"nvd","sourceId":"CVE-2026-102489","modified":"2026-10-10T04:18:08.040","url":"https://zammad.com/en/advisories/cve-2026-102489-cve-2026-102490"}]},{"url":"https://community.zammad.org/t/take-care-local-privilege-escalation-cve-2026-102490-is-reported-as-being-actively-exploited/21297/2","tags":["technical-description","Vendor Advisory"],"source":"mitre","sourceId":"DIVD","modified":"2026-10-19T09:10:59.656Z","origins":[{"source":"mitre","sourceId":"DIVD","modified":"2026-10-19T09:10:59.656Z","url":"https://community.zammad.org/t/take-care-local-privilege-escalation-cve-2026-102490-is-reported-as-being-actively-exploited/21297/2"},{"source":"nvd","sourceId":"CVE-2026-102489","modified":"2026-10-10T04:18:08.040","url":"https://community.zammad.org/t/take-care-local-privilege-escalation-cve-2026-102490-is-reported-as-being-actively-exploited/21297/2"}]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-102489","tags":["government-resource","US Government Resource"],"source":"mitre","sourceId":"CISA-ADP","modified":"2026-10-10T03:55:20.097Z","origins":[{"source":"mitre","sourceId":"CISA-ADP","modified":"2026-10-10T03:55:20.097Z","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-102489"},{"source":"nvd","sourceId":"CVE-2026-102489","modified":"2026-10-10T04:18:08.040","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-102489"}]},{"source":"euvd","sourceId":"EUVD-2026-90080","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-90080","tags":["ADVISORY"],"origins":[{"source":"euvd","sourceId":"EUVD-2026-90080","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-90080"}]},{"url":"https://vulncheck.com/kev","tags":["ADVISORY"],"source":"vulncheck-kev","sourceId":"CVE-2026-102489","modified":"2026-09-30T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-102489","modified":"2026-09-30T00:00:00Z","url":"https://vulncheck.com/kev"}]},{"url":"https://csirt.divd.nl/cases/DIVD-2026-00015/","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2026-102489","modified":"2026-09-30T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-102489","modified":"2026-09-30T00:00:00Z","url":"https://csirt.divd.nl/cases/DIVD-2026-00015/"}]},{"url":"https://euvd.enisa.europa.eu/enisa/EUVD-2026-90080","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2026-102489","modified":"2026-09-30T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-102489","modified":"2026-09-30T00:00:00Z","url":"https://euvd.enisa.europa.eu/enisa/EUVD-2026-90080"}]},{"url":"https://www.linkedin.com/posts/zammad-share-7511092586393010176-RkCb/","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2026-102489","modified":"2026-09-30T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-102489","modified":"2026-09-30T00:00:00Z","url":"https://www.linkedin.com/posts/zammad-share-7511092586393010176-RkCb/"}]},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2026-102489","modified":"2026-09-30T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-102489","modified":"2026-09-30T00:00:00Z","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json"}]},{"url":"https://vulncheck.com/xdb/a1738d002f00","tags":["XDB catalogue"],"source":"vulncheck-kev","sourceId":"a1738d002f00","modified":"2026-09-30T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"a1738d002f00","modified":"2026-09-30T00:00:00Z","url":"https://vulncheck.com/xdb/a1738d002f00"}]},{"url":"https://github.com/horizon3ai/CVE-2026-102489","tags":["XDB repository"],"source":"vulncheck-kev","sourceId":"a1738d002f00","modified":"2026-09-30T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"a1738d002f00","modified":"2026-09-30T00:00:00Z","url":"https://github.com/horizon3ai/CVE-2026-102489"}]},{"url":"https://vulncheck.com/xdb/686fd6ff8f76","tags":["XDB catalogue"],"source":"vulncheck-kev","sourceId":"686fd6ff8f76","modified":"2026-09-30T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"686fd6ff8f76","modified":"2026-09-30T00:00:00Z","url":"https://vulncheck.com/xdb/686fd6ff8f76"}]},{"url":"https://github.com/1xPwn/CVE-2026-102489","tags":["XDB repository"],"source":"vulncheck-kev","sourceId":"686fd6ff8f76","modified":"2026-09-30T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"686fd6ff8f76","modified":"2026-09-30T00:00:00Z","url":"https://github.com/1xPwn/CVE-2026-102489"}]}],"packages":[],"pocCandidates":[{"url":"https://github.com/horizon3ai/CVE-2026-102489","source":"poc-in-github","sourceId":"CVE-2026-102489","description":"Zammad Session Leak to Remote Code Execution","modified":"2026-10-20T16:49:50Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2026-102489","url":"https://github.com/horizon3ai/CVE-2026-102489"},{"source":"poc-in-github","sourceId":"CVE-2026-102489","modified":"2026-10-20T16:49:50Z","url":"https://github.com/horizon3ai/CVE-2026-102489"}],"tags":[]},{"url":"https://github.com/Hunt-Benito/the-cookie-in-the-error-message-cve-2026-102489-zammad-session-hijack-to-rce","source":"poc-in-github","sourceId":"CVE-2026-102489","modified":"2026-10-07T09:56:01Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2026-102489","url":"https://github.com/Hunt-Benito/the-cookie-in-the-error-message-cve-2026-102489-zammad-session-hijack-to-rce"},{"source":"poc-in-github","sourceId":"CVE-2026-102489","modified":"2026-10-07T09:56:01Z","url":"https://github.com/Hunt-Benito/the-cookie-in-the-error-message-cve-2026-102489-zammad-session-hijack-to-rce"}],"tags":[]},{"url":"https://github.com/1xPwn/CVE-2026-102489","source":"poc-in-github","sourceId":"CVE-2026-102489","description":"CVE-2026-102489 exploit in golang","modified":"2026-10-20T16:49:53Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2026-102489","url":"https://github.com/1xPwn/CVE-2026-102489"},{"source":"poc-in-github","sourceId":"CVE-2026-102489","modified":"2026-10-20T16:49:53Z","url":"https://github.com/1xPwn/CVE-2026-102489"}],"tags":[]}],"cataloguedPoc":[{"source":"vulncheck-kev","kind":"vulncheck-xdb","verification":"catalogued","sourceId":"a1738d002f00","url":"https://vulncheck.com/xdb/a1738d002f00","cve":"CVE-2026-102489","dateAdded":"2026-10-06T19:00:36Z","modified":"2026-09-30T00:00:00Z","exploitType":"initial-access","repositoryUrl":"https://github.com/horizon3ai/CVE-2026-102489","observations":[{"dateAdded":"2026-10-06T19:00:36Z","exploitType":"initial-access"}],"tags":[],"origins":[{"source":"vulncheck-kev","sourceId":"a1738d002f00","modified":"2026-09-30T00:00:00Z","url":"https://vulncheck.com/xdb/a1738d002f00"}]},{"source":"vulncheck-kev","kind":"vulncheck-xdb","verification":"catalogued","sourceId":"686fd6ff8f76","url":"https://vulncheck.com/xdb/686fd6ff8f76","cve":"CVE-2026-102489","dateAdded":"2026-10-12T16:00:33Z","modified":"2026-09-30T00:00:00Z","exploitType":"initial-access","repositoryUrl":"https://github.com/1xPwn/CVE-2026-102489","observations":[{"dateAdded":"2026-10-12T16:00:33Z","exploitType":"initial-access"}],"tags":[],"origins":[{"source":"vulncheck-kev","sourceId":"686fd6ff8f76","modified":"2026-09-30T00:00:00Z","url":"https://vulncheck.com/xdb/686fd6ff8f76"}]}],"vendorStatements":[],"exploitationSources":[{"source":"euvd","sourceId":"EUVD-2026-90080","catalog":"ENISA EU KEV","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-90080","dateAdded":"2026-09-30","origins":[{"source":"euvd","sourceId":"EUVD-2026-90080","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-90080"}]},{"source":"vulncheck-kev","sourceId":"CVE-2026-102489","catalog":"VulnCheck KEV","kind":"catalogue","url":"https://vulncheck.com/kev","dateAdded":"2026-09-30T00:00:00Z","modified":"2026-09-30T00:00:00Z","requiredAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","knownRansomwareCampaignUse":"Unknown","reportedByVulncheckCanaries":false,"vendorProject":"Zammad GmbH","product":"Zammad","dueDate":"2026-10-05T00:00:00Z","cisaDateAdded":"2026-10-02T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-102489","modified":"2026-09-30T00:00:00Z","url":"https://vulncheck.com/kev"}]},{"source":"vulncheck-kev","sourceId":"CVE-2026-102489","catalog":"VulnCheck KEV","kind":"report","url":"https://csirt.divd.nl/cases/DIVD-2026-00015/","dateAdded":"2026-09-30T00:00:00Z","firstPartyCanary":false,"origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-102489","url":"https://csirt.divd.nl/cases/DIVD-2026-00015/"},{"source":"vulncheck-kev","sourceId":"CVE-2026-102489","url":"https://euvd.enisa.europa.eu/enisa/EUVD-2026-90080"},{"source":"vulncheck-kev","sourceId":"CVE-2026-102489","url":"https://www.linkedin.com/posts/zammad-share-7511092586393010176-RkCb/"}]},{"source":"vulncheck-kev","sourceId":"CVE-2026-102489","catalog":"VulnCheck KEV","kind":"report","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","dateAdded":"2026-10-02T00:00:00Z","firstPartyCanary":false,"origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-102489","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json"}]}]}