Horizon3.ai Discovers Actively Exploited Zammad Vulnerability CVE-2026-102489

Security researchers at Horizon3.ai published first-hand analysis of CVE-2026-102489, identifying a critical vulnerability within the Zammad customer service software. The firm states that threat actors are actively exploiting this flaw to compromise systems in real-time environments.

The vulnerability enables attackers to expose sensitive user session cookies by triggering specific errors within the application’s WebSocket connections. According to Horizon3.ai, this exposure facilitates session hijacking, allowing adversaries to impersonate legitimate users. The research further indicates that the flaw could potentially lead to remote code execution on affected servers.

Technical Context and Impact

The core issue lies in how Zammad handles WebSocket communication errors, as detailed in the Horizon3.ai report. When these errors occur, the application improperly reveals user session cookies rather than handling them securely. This behavior bypasses standard authentication checks for subsequent requests made using the stolen cookies.

Session hijacking is the primary immediate risk identified by the researchers. By capturing these cookies, attackers can gain unauthorized access to user accounts without needing valid credentials. The potential for remote code execution adds a severe layer of risk, as it could allow full control over the underlying server infrastructure hosting the Zammad instance.

Affected Systems and Scope

Zammad is an open-source customer support ticketing system used by organizations to manage customer inquiries and internal support requests. Any deployment of Zammad that has not been patched against CVE-2026-102489 is considered vulnerable to this attack vector.

Horizon3.ai’s research indicates that the exploitation is already active, meaning unpatched instances are likely under attack. Organizations relying on Zammad for critical customer support operations face immediate risk of data breach and service disruption. The severity is rated as critical due to the ease of exploitation and the high impact of session hijacking and potential remote code execution.

What should you do?

Organizations using Zammad should immediately verify if their instances are vulnerable to CVE-2026-102489. Administrators should monitor network logs for unusual WebSocket traffic patterns that could indicate exploitation attempts. Since the vulnerability is actively exploited, incident response teams should prepare for potential session hijacking events and review access logs for suspicious activity originating from known compromised sessions.

What to do and how to stay safe: Zammad

• Audit current Zammad versions against the CVE-2026-102489 disclosure to determine exposure status.
• Monitor server logs for abnormal WebSocket error rates or unexpected session cookie disclosures.
• Implement strict network segmentation to limit the impact of potential remote code execution.
• Prepare incident response plans for session hijacking scenarios until a vendor fix is confirmed.

Step-by-step guide: Risk Based Vulnerability Management: Prioritize Fixes by Actual Threat

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is CVE-2026-102489?

CVE-2026-102489 is a critical vulnerability in Zammad that exposes user session cookies through WebSocket errors, enabling session hijacking and potential remote code execution.

Is CVE-2026-102489 being exploited in the wild?

Yes, according to Horizon3.ai, the vulnerability is currently being actively exploited by threat actors in live environments.

What is the main risk of this vulnerability?

The primary risk is session hijacking via exposed cookies, with a secondary risk of remote code execution on the server.