Zammad versions 6.3.0 to 6.5.4 are vulnerable to a session hijacking flaw that leads to remote code execution as the zammad user. The flaw is also present in versions 7.0.0 to 7.1.3 but is not exploitable there because of environment conditions. The Dutch Institute for Vulnerability Disclosure (DIVD) found it in collaboration with Merlon Security and named it publicly on 30 September 2026 as one of two zero-days chained in the breach of DIVD's own network, where the pair together enabled session hijacking, remote code execution and a jump to root "in seconds" under agentic control. DIVD recommends upgrading to Zammad version 7 or taking instances offline.

• BleepingComputer