CISA Adds Two Actively Exploited Zammad Vulnerabilities to KEV Catalog
Summary
CISA added two Zammad vulnerabilities to its Known Exploited Vulnerabilities Catalog based on evidence of active exploitation and urged organizations to prioritize remediation.
Key points
- CISA added CVE-2026-102489, a Zammad session fixation vulnerability, to its KEV Catalog.
- CISA also added CVE-2026-102490, a Zammad improper privilege management vulnerability.
- The additions are based on evidence that both vulnerabilities are being actively exploited.
- Federal civilian agencies must prioritize remediation of KEV-listed vulnerabilities under BOD 26-04 and check for possible compromise before patching.
- CISA encourages all organizations to prioritize remediation of KEV-listed vulnerabilities using risk-based vulnerability management.
Article Details
- Vulnerability Types
- Session fixation
- Improper privilege management
- Exploitation Status
- active
- Exploit Availability
- unknown
- Patch Status
- unknown