Exploited Zammad bug leaks helpdesk session cookies through Ruby error output

The CVSS 3.x score is 9.8 ^[8], but the entry requirements tell you more. The attacker needs no account. All it takes is a crafted event sent to Zammad's WebSocket handler ^[3]. What comes back depends on who is connected at that moment ^[3]. A replayed cookie becomes that user's session ^[4], with reach into the support tickets, customer records and credentials the application can access ^[7]. Code execution as the zammad system user is the end state Horizon3 describes, and root needs a separate privilege-escalation step ^[6].

The version range is not settled. DIVD's narrative advisory lists 6.3.0 through 6.5.4 as vulnerable, while its structured CVE data runs from 6.3.0 up to but excluding 6.5.4 ^[9]. Horizon3 says 6.5.4 should not be treated as a confirmed fixed release ^[9]. Zammad says 7.0 and later are not affected in practice ^[10]. It also says 7.2.0 hardens the affected code ^[11]. DIVD recommends upgrading to version 7 or taking the instance offline, and its advisory lists no workaround ^[13].

The dates are tight. DIVD reported the flaw on September 24 ^[15]. The CVE record went public on September 30, though DIVD's own advisory lists September 29 ^[17]. Zammad published its statement recommending 7.2.0 on October 1 ^[18]. CISA listed the flaw as exploited on October 2 ^[2], eight days after DIVD's first report ^[21]. Horizon3's timeline gives its own customer alert and test release only as "October XX, 2026" ^[20].

On the public record, exploitation in the wild is established by the KEV listing, which Horizon3's write-up cites ^[2]. Horizon3's write-up does not name who exploited the bug, tie it to a campaign, or say how many public instances DIVD's scan found. On this evidence it is one exploited bug in a helpdesk that DIVD found exposed on the internet ^[16], with no actor attached. Horizon3's attack research team reverse engineered the flaw ^[19]. Its public text gives the path in outline only. The working check runs inside its commercial NodeZero platform ^[19]. Exploitation was on CISA's list by October 2 ^[2], so the case for upgrading does not depend on how fast others reproduce Horizon3's work.

For triage, DIVD has published a script that searches application and web server logs for session material in error output, matching entries that contain "Cookie"=> or @clients={ ^[14]. Horizon3 says matches warrant investigation for session disclosure and later abuse, and that an absence of matches does not rule out compromise ^[14].