CISA Adds Two Known Exploited Vulnerabilities to Catalog

CISA has added two actively exploited vulnerabilities in Zammad GmbH software (CVE-2026-102489 and CVE-2026-102490) to its Known Exploited Vulnerabilities Catalog, signaling real-world threat actor activity. The addition under Binding Operational Directive BOD 26-04 mandates federal agencies to remediate these flaws on publicly exposed assets within defined timelines. Organizations that delay patching known, catalogued vulnerabilities leave themselves exposed to threats that are no longer theoretical — they are actively being weaponized. This incident underscores that timely, prioritized patch management based on exploitation evidence is a critical security control, not an optional best practice.