Organizations Hit by Active Zammad Attacks Face Cookie Theft and Remote Code Execution

Horizon3.ai published technical details on CVE-2026-102489, identifying it as a critical vulnerability within the Zammad customer support system. The security firm confirmed that this flaw is actively exploited in the wild, posing immediate risks to organizations relying on the platform for ticketing and communication. The discovery highlights a significant gap in how the application handles real-time data connections.

The risk

The vulnerability allows attackers to access sensitive user session cookies through errors generated by WebSocket connections. According to Horizon3.ai, these exposed cookies enable session hijacking, where an attacker impersonates a legitimate user without needing their password. The research indicates that the flaw also creates a pathway for potential remote code execution on the server hosting the Zammad instance.

Who is exposed

Any organization running the Zammad platform is potentially exposed to this threat. Small businesses and enterprises using Zammad for customer relationship management or IT service desk functions face direct risk. The active exploitation status reported by Horizon3.ai suggests that threat actors are already scanning for and targeting vulnerable installations to steal credentials or gain deeper system access.

Cost and compliance

The source material does not specify financial damages or regulatory penalties associated with this specific incident. However, the exposure of session cookies and potential for remote code execution typically violates data protection standards. Organizations must consider the operational impact of compromised support tickets and unauthorized system access when assessing the business risk of CVE-2026-102489.

What happens next

Managers should immediately verify their Zammad version against vendor advisories for CVE-2026-102489. Since no patch is confirmed in the source material, teams should monitor for official updates from the Zammad development team. Until a fix is available, restricting external access to the WebSocket endpoints may reduce the attack surface for this specific vector.

What to do and how to stay safe: Zammad

• Review server logs for unusual WebSocket error patterns or unauthorized connection attempts from known IP addresses.
• Restrict access to the Zammad interface using network-level controls such as firewalls or virtual private networks.
• Monitor user accounts for signs of session hijacking, such as unexpected ticket updates or access from new locations.
• Prepare an incident response plan to quickly isolate affected systems if remote code execution is suspected.

Step-by-step guide: Vulnerability Prioritization: Fix What Actually Breaks Your Business

General security guidance from the CloudSec Pulse newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is CVE-2026-102489?

It is a critical vulnerability in Zammad that exposes session cookies via WebSocket errors, allowing session hijacking and potential remote code execution.

Is this vulnerability currently being used by attackers?

Yes, Horizon3.ai reports that CVE-2026-102489 is actively exploited in the wild.

Does a patch exist for this flaw?

The provided source material does not confirm the availability of a patch or fix for CVE-2026-102489.