CISA Adds Two Known Exploited Vulnerabilities to Catalog (CVE-2026-102489, CVE-2026-102490)
CISA added two actively exploited Zammad vulnerabilities to the KEV Catalog, requiring urgent patching of session fixation and privilege management flaws. CVE-2026-102489 (session fixation) and CVE-2026-102490 (improper privilege management) in Zammad are being actively exploited per CISA. Federal agencies must remediate per BOD 26-04 and check for prior compromise.
Detection / Hunteropenrouter
Immediate Actions
- Patch Zammad to the latest version fixing both CVE-2026-102489 and CVE-2026-102490
- Check Zammad systems for evidence of prior compromise before patching
- Review Zammad authentication logs for anomalous session activity
Key Takeaways
- Two Zammad vulnerabilities added to CISA KEV Catalog on October 2, 2026
- CVE-2026-102489 enables session fixation attacks against Zammad instances
- CVE-2026-102490 allows improper privilege management in Zammad
- BOD 26-04 mandates FCEB agencies patch and verify no prior compromise
- CISA encourages all organizations to prioritize KEV Catalog remediation
Attack Chain
- Initial Access: Attacker exploits Zammad session fixation to hijack user sessions (CVE-2026-102489)
- Privilege Escalation: Attacker exploits improper privilege management for elevated access (CVE-2026-102490)
- Impact: Attacker gains unauthorized access to Zammad data and functionality
Affected Systems
- Zammad customer support platform
Vulnerabilities (CVEs)
| CVE | Product | Severity | Description |
|---|---|---|---|
| CVE-2026-102489 | Zammad GmbH Zammad | Session fixation allows attacker to hijack user sessions. | |
| CVE-2026-102490 | Zammad GmbH Zammad | Improper privilege management allows unauthorized privilege escalation. |
Detection Availability
No detection rules or queries are published in the source article.
Detection Engineering Assessment
Hypotheses are starting points derived from the article, not findings about your environment; validate against your own telemetry.
| Dimension | Rating | Rationale |
|---|---|---|
| EDR Visibility | Low | These are application-layer web vulnerabilities; EDR may not see exploitation. |
| Network Visibility | Medium | Web server and reverse proxy logs may capture exploitation attempts. |
| Detection Difficulty | Hard | Session fixation and privilege management flaws require application-specific logging. |
Hunting Hypotheses
| Hypothesis | Telemetry | Stage | FP Risk |
|---|---|---|---|
| Sessions with IDs used across multiple source IPs or users may indicate session fixation (T1185) | Zammad application and web server session logs | Initial Access | Medium — shared NAT or proxy IPs may cause false hits |
| Users showing unexpected privilege level changes in Zammad may indicate exploitation (T1068) | Zammad user privilege audit logs | Privilege Escalation | Low — privilege changes are rare and logged |
Required Log Sources
- Zammad application logs
- Web server access logs
- Authentication and session logs
- Reverse proxy logs
Key Behavioral Indicators
- Same session ID observed from multiple source IP addresses
- Sudden privilege level changes for Zammad user accounts
- Authentication events with mismatched session-to-user mappings
- Unexpected administrative actions from previously standard users
Control Gaps
- Signature-based detection won't catch application logic exploitation
- Standard EDR lacks visibility into web application session handling
- Network IDS may miss encrypted session manipulation
False Positive Assessment
Low — CISA confirmed active exploitation of both vulnerabilities
Recommendations
Suggestions to evaluate against your own environment, tooling, and incident-response procedures — not directives.
Infrastructure Hardening
- Restrict external network access to Zammad instances where possible
- Deploy WAF rules to detect and block session fixation attempts
- Enforce session rotation after authentication to prevent fixation
User Protection
- Monitor Zammad user accounts for unexpected privilege changes
- Force password resets for accounts with suspicious session activity
MITRE ATT&CK Mapping
Privilege Escalation
Collection
Plain-Language Summary
CISA confirmed that two security flaws in the Zammad support platform are being actively exploited by attackers. The flaws allow session hijacking and unauthorized privilege escalation. Organizations running Zammad should patch immediately and investigate whether attackers already compromised their systems.
- cveCVE-2026-102489Session fixation allows attacker to hijack user sessions.
- cveCVE-2026-102490Improper privilege management allows unauthorized privilege escalation.