October 8, 2026 · 1 min read
CVE-2026-102489: Zammad GmbH Zammad exploitation alert
CISA added CVE-2026-102489 to its Known Exploited Vulnerabilities catalog on 2026-10-02. Review affected Zammad GmbH Zammad deployments and vendor mitigation guidance.
CVE-2026-102489: what changed
CISA added this vulnerability to its Known Exploited Vulnerabilities catalog on 2026-10-02. Inclusion indicates evidence of exploitation; it does not establish that your own systems have been compromised.
Affected product
Zammad GmbH Zammad. Confirm affected versions against the vendor advisory.
CISA description
Zammad GmbH Zammad contains a session fixation vulnerability that can lead to remote code execution as the zammad user. This vulnerability can be chained with CVE-2026-102490.
Recommended response
Inventory affected deployments, check vendor guidance for fixes or mitigations, and verify the update was applied. Review available logs and incident-response guidance when exploitation is suspected.
Catalog context
CISA lists a remediation due date of 2026-10-05. Federal directive deadlines have a defined scope; other organizations should prioritize according to their exposure and risk. Ransomware campaign use is listed as unknown; “unknown” does not mean exploitation is absent.
Sources
Automated security brief based on CISA catalog data. Catalog addition date: 2026-10-02.