CISA adds Zammad flaws to the KEV catalog
On October 2, 2026, CISA added two Zammad vulnerabilities to the KEV catalog after identifying evidence of active exploitation.
Source: CISA adiciona duas vulnerabilidades exploradas ao catálogo KEV (cisa.gov). Text prepared with AI from this source.
What happened and what to do
On October 2, 2026, CISA added two Zammad vulnerabilities with evidence of active exploitation to its Known Exploited Vulnerabilities (KEV) catalog: CVE-2026-102489, a session fixation flaw, and CVE-2026-102490, involving inadequate privilege management. Directive BOD 26-04 requires covered federal agencies to prioritize KEV vulnerabilities in internet-facing assets and check for possible compromise before applying patches. CISA recommends that all organizations use risk-based vulnerability management.
A company using Zammad can inventory its instances and internet exposure, check affected versions, and prioritize remediation. It can also record patch evidence and investigate signs of compromise before closing an incident. A KEV monitoring workflow integrated with the asset inventory and incident response process can help coordinate these actions.
How the consultancy can help
Wendelmaques can assess Zammad exposure and response capabilities, define a remediation and investigation scope, and implement monitoring integrated with the asset inventory, with operations suited to the company’s environment.
Next step
Send a short description of your Zammad environment and current vulnerability management process to receive a scoped proposal.
Let's assess your project
I reply with scope and a proposal.