[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fD6GjuN9AP_RFNbNOWsfmiUDl0rq0PRGfDAO9-oagqAk":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":21,"status":22,"created_at":23,"published_at":24,"article":25,"tags":29,"podcasts":42,"controls":43},"a2d6dc3c-984a-416f-8dd8-9a685a8f6efd","cisa-flags-actively-exploited-zammad-vulnerabilities-patch-now","8aa9abdf-1780-427d-aaba-cf3ee910d15e","CISA Flags Actively Exploited Zammad Vulnerabilities — Patch Now","CISA has added two actively exploited vulnerabilities in Zammad GmbH software (CVE-2026-102489 and CVE-2026-102490) to its Known Exploited Vulnerabilities Catalog, signaling real-world threat actor activity. The addition under Binding Operational Directive BOD 26-04 mandates federal agencies to remediate these flaws on publicly exposed assets within defined timelines. Organizations that delay patching known, catalogued vulnerabilities leave themselves exposed to threats that are no longer theoretical — they are actively being weaponized. This incident underscores that timely, prioritized patch management based on exploitation evidence is a critical security control, not an optional best practice.","**Immediate Actions:**\n- Apply vendor-supplied patches or upgrades for Zammad software to the latest available version immediately.\n- Audit all internet-facing assets running Zammad and isolate or take offline any instances that cannot be patched right away.\n\n**Long-term Improvements:**\n- Subscribe to CISA's KEV Catalog feed and integrate it into your vulnerability management workflow to trigger automatic prioritization of catalogued CVEs.\n- Maintain a continuously updated inventory of all software and versions deployed across your environment to accelerate patch impact assessments.\n- Establish and rehearse an emergency patching procedure with defined SLAs for critical and actively exploited vulnerabilities.\n\n**Detection Measures:**\n- Deploy vulnerability scanning tools configured to flag KEV Catalog entries as critical-priority findings requiring immediate escalation.\n- Monitor network logs and SIEM alerts for anomalous activity targeting Zammad endpoints, such as unusual authentication attempts or unexpected API calls.",[12,13,14,15,16,17,18,19,20],"CIS Control 7 – Continuous Vulnerability Management","CIS Control 2 – Inventory and Control of Software Assets","NIST SP 800-53 SI-2 – Flaw Remediation","NIST SP 800-53 RA-5 – Vulnerability Monitoring and Scanning","NIST Cybersecurity Framework ID.RA-1 – Asset Vulnerabilities Identified","CISA BOD 22-01 – Reducing the Significant Risk of Known Exploited Vulnerabilities","CISA BOD 26-04 – Federal Vulnerability Remediation Directive","ITIL 4 – Change Enablement (Emergency Change Process)","NIST SP 800-40 – Guide to Enterprise Patch Management Planning",{},"published","2026-10-02T22:20:21.365052+00:00","2026-10-02T22:20:21.075+00:00",{"id":7,"url":26,"slug":27,"title":28},"https:\u002F\u002Fwww.cisa.gov\u002Fnews-events\u002Falerts\u002F2026\u002F10\u002F02\u002Fcisa-adds-two-known-exploited-vulnerabilities-catalog","cisa-adds-two-known-exploited-vulnerabilities-to-catalog-0ed309","CISA Adds Two Known Exploited Vulnerabilities to Catalog",[30,36],{"id":31,"name":32,"slug":33,"description":34,"color":35},"05757c8d-6b93-4194-b35d-7359e7d33b0e","Vulnerability Management","vulnerability-management","Missing scans, no risk prioritization","#fb923c",{"id":37,"name":38,"slug":39,"description":40,"color":41},"af7fce9e-1ce8-4156-93bc-09dcfbfdf29d","Patch Management","patch-management","Unpatched vulnerabilities, delayed updates","#ef4444",[],[44,47,50],{"slug":33,"name":45,"problem":46},"Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",{"slug":39,"name":48,"problem":49},"Automated patch management","Known holes get closed in days, not months.",{"slug":51,"name":52,"problem":53},"asset-inventory","Cyber asset inventory","You cannot patch, monitor or protect the devices, cloud resources and accounts you do not know you have."]