Katalog CVE
CVSS 9.8 · Critical
KEV · sudah dieksploitasi
EPSS 1,3%
Kerentanan Session Fixation pada zammad. Skor CVSS 3.1 9.8 (Critical) menurut NVD. Masuk katalog KEV CISA pada 2 Oktober 2026, artinya sudah terbukti dieksploitasi.
Deskripsi (NVD)
Zammad versions 6.3.0 to 6.5.4 are vulnerable a session hijack vulnerability that leads to remote code execution as the zammad user. The bug is also present in version 7.0.0 to version 7.1.2, but not exploitable due to changes in the underlying framework.
Rincian
- Terbit di NVD
- 30 September 2026
- Terakhir diubah
- 10 Oktober 2026
- Status NVD
- Analyzed
- CVSS 3.1
- 9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
· uraikan di kalkulator
- Jenis kelemahan (CWE)
-
CWE-384: Session Fixation
- EPSS (30 hari)
- 1,3% peluang dieksploitasi; lebih tinggi dari 68,7% CVE lain
Known Exploited Vulnerabilities (CISA)
- Nama
- Zammad GmbH Zammad Session Fixation Vulnerability
- Masuk KEV
- 2 Oktober 2026
- Tenggat CISA
- 5 Oktober 2026 (untuk instansi federal AS)
- Ransomware
- Belum tercatat
- Tindakan wajib
- Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Produk dan versi terdampak
| Vendor | Produk | Versi terdampak |
|---|
| zammad |
zammad |
Versi 6.3.0 hingga 6.5.4 |
> Data dari konfigurasi CPE di NVD.
Referensi dan perbaikan
Sumber:
NVD ·
CVE.org
·
KEV CISA
·
EPSS.
Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 10 Okt 2026, 18:25 WITA.
Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat
kanal pelaporan.