原始描述
Zammad versions 6.3.0 to 6.5.4 are vulnerable a session hijack vulnerability that leads to remote code execution as the zammad user. The bug is also present in version 7.0.0 to version 7.1.2, but not exploitable due to changes in the underlying framework.
已知被利用（CISA KEV）
- 加入 KEV 日期
- 2026-10-02
- 修复期限（美国联邦机构）
- 2026-10-05
- 用于勒索软件
- Unknown
- 要求采取的措施
- Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
详情
- 发布日期
- 2026-10-01
- 最后修改
- 2026-10-19
- CVSS 向量
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:A/AU:Y/V:C- EPSS（30 天内被利用概率）
- 49.92% (百分位 99)
参考资料
本产品使用 NVD API 的数据，但未获得 NVD 的认可或认证。CVE® 是 The MITRE Corporation 的注册商标；CVE 记录依据 CVE Program 使用条款使用。