CISA Flags Actively Exploited Zammad Vulnerabilities — Patch Now
Written by AI from the linked story. Not reviewed by an editor. How this works
CISA has added two actively exploited vulnerabilities in Zammad GmbH software (CVE-2026-102489 and CVE-2026-102490) to its Known Exploited Vulnerabilities Catalog, signaling real-world threat actor activity. The addition under Binding Operational Directive BOD 26-04 mandates federal agencies to remediate these flaws on publicly exposed assets within defined timelines. Organizations that delay patching known, catalogued vulnerabilities leave themselves exposed to threats that are no longer theoretical — they are actively being weaponized. This incident underscores that timely, prioritized patch management based on exploitation evidence is a critical security control, not an optional best practice.
Tactical Insight
Immediate Actions
- Apply vendor-supplied patches or upgrades for Zammad software to the latest available version immediately.
- Audit all internet-facing assets running Zammad and isolate or take offline any instances that cannot be patched right away.
Long-term Improvements
- Subscribe to CISA's KEV Catalog feed and integrate it into your vulnerability management workflow to trigger automatic prioritization of catalogued CVEs.
- Maintain a continuously updated inventory of all software and versions deployed across your environment to accelerate patch impact assessments.
- Establish and rehearse an emergency patching procedure with defined SLAs for critical and actively exploited vulnerabilities.
Detection Measures
- Deploy vulnerability scanning tools configured to flag KEV Catalog entries as critical-priority findings requiring immediate escalation.
- Monitor network logs and SIEM alerts for anomalous activity targeting Zammad endpoints, such as unusual authentication attempts or unexpected API calls.