CVE-2026-102489Vulnerability

1. “According to Horizon3.ai and Sysdig, CVE-2026-102489 is a remote code execution flaw affecting versions 6.3.0 to 6.5.4, while CVE-2026-102490 is a local privilege escalation (LPE) flaw affecting all versions from 1.5.0 to 7.1.0-alpha.”

   The Hacker NewsNews12 Oct 2026
   ⚡ Weekly Recap: Helpdesk 0-Days, Rogue Certs, ShinyHunters Arrest, AI-Fooling Malware and More

2. “CVE-2026-102489 | Technical Details”

   Horizon3.aiVendor8 Oct 2026
   CVE-2026-102489 | Technical Details

3. “Zammad CVE-2026-102489: Session Leak to RCE”

   Horizon3.aiVendor7 Oct 2026
   Zammad CVE-2026-102489: Session Leak to RCE

4. “…3, CVE-2026-102104, CVE-2026-102105, CVE-2026-102106, CVE-2026-102115, CVE-2026-102095, CVE-2026-85066, CVE-2026-85065 (Kiteworks), CVE-2026-102489, CVE-2026-102490 (Zammad), CVE-2026-63292, CVE-2026-42356, CVE-2026-42528 (Apache HTTP Server), CVE-2026-101898, CVE-2026-101901, CV…”

   The Hacker NewsNews5 Oct 2026
   ⚡ Weekly Recap: NetScaler and FortiMail 0-Days, AI Coding Leaks, Spectre v2 and Ransomware Arrests

5. “CVE-2026-102489”

   CERT-FRGovernment5 Oct 2026
   Bulletin d'actualité CERTFR-2026-ACT-042 (05 octobre 2026)

6. “CVE-2026-102489 (CVSS score of 9.4) Zammad GmbH Zammad Session Fixation Vulnerability”

   Security AffairsNews2 Oct 2026
   U.S. CISA adds Zammad GmbH Zammad flaws to its Known Exploited Vulnerabilities catalog

7. “CVE-2026-102489 Zammad GmbH Zammad Session Fixation Vulnerability”

   CISA advisoriesGovernment2 Oct 2026
   CISA Adds Two Known Exploited Vulnerabilities to Catalog

8. “The vulnerabilities exploited in the attack are remote code execution bug CVE-2026-102489 and elevation of privileges flaw CVE-2026-102490, both of which have a CVSS score of 9.4 when chained.”

   Infosecurity MagazineNews2 Oct 2026
   Two Zero-Days Exploited in Attack on Dutch Institute for Vulnerability Disclosure

9. “They are CVE-2026-102489 and CVE-2026-102490, and both bugs received CVSS 4.0 scores of 9.4, when assessed in the chained attack scenario.”

   The Register (security)News1 Oct 2026
   AI agents hacked the hackers, stealing email addresses from security research org

10. “Two zero-day vulnerabilities in the open-source Zammad ticketing system, CVE-2026-102489 and CVE-2026-102490, have been chained by threat actors to break into the Dutch Institute for Vulnerability Disclosure (DIVD).”

    The Hacker NewsNews1 Oct 2026
    ThreatsDay: AI-Powered Zero-Day Chain, 543K Live Secrets, Model Inspection RCE and 13 More Stories

11. “CVE-2026-102489, which allows attackers to remotely execute malicious code without logging in, affects Zammad versions 6.3.0 to 6.5.4.”

    Help Net SecurityNews1 Oct 2026
    AI agent used Zammad zero-days to breach Dutch vulnerability disclosure non-profit

12. “The first flaw, CVE-2026-102489 (CVSS score of 9.4), enables unauthenticated attackers to achieve remote code execution and leak user sessions.”

    SecurityWeekNews1 Oct 2026
    Zammad Zero-Days Exploited in AI-Powered DIVD Hack

13. “Working with Merlon Security, DIVD identified two previously unknown vulnerabilities, tracked as CVE-2026-102489 and CVE-2026-102490.”

    Security AffairsNews1 Oct 2026
    AI Agent Chains Zammad Zero-Days To Take Over DIVD Systems in Seconds

14. “De eerste kwetsbaarheid heeft het kenmerk CVE-2026-102489 toegekend gekregen.”

    NCSC-NL advisoriesGovernment30 Sep 2026
    NCSC-2026-0396 [1.00] [H/H] Kwetsbaarheden aangetroffen in Zammad

• csirt.divd[.]nlin 2 reports
• www.moxa[.]comin 1 report

Also named with it: CVE-2026-102490, CVE-2026-89078, CVE-2026-93577, CVE-2026-102331, CVE-2026-76504, CVE-2026-104286, CVE-2026-88779, CVE-2026-81963, CVE-2026-81578, CVE-2026-82078, CVE-2026-73581, CVE-2026-75973, CVE-2026-76183, CVE-2026-77791, CVE-2026-78383, CVE-2026-78437, CVE-2026-79677, CVE-2026-86248