CISA added two actively exploited Zammad vulnerabilities to the KEV Catalog, requiring urgent patching of session fixation and privilege management flaws. CVE-2026-102489 (session fixation) and CVE-2026-102490 (improper privilege management) in Zammad are being actively exploited per CISA. Federal agencies must remediate per BOD 26-04 and check for prior compromise.
Session Fixation
1 post
CISA Adds Two Known Exploited Vulnerabilities to Catalog (CVE-2026-102489, CVE-2026-102490)