PoC Exploit Released for Critical Zammad Flaw Enabling Session Hijacking and Remote Code Execution

A proof-of-concept exploit for CVE-2026-102489, a Zammad vulnerability that chains unauthenticated session disclosure into session hijacking and remote code execution. Researcher Zach Hanley published the technical analysis on October 7, 2026, showing how exposed administrator cookies let attackers execute commands as the Zammad operating system user. The disclosure follows a breach at the Dutch Institute for Vulnerability Disclosure (DIVD) , which publicly reported the…