Zammad GmbH Zammad · Exploitation confirmed

CISA confirms active exploitation of two Zammad flaws

Oct 01, 2026 · 1 min read

CISA added Zammad flaws CVE-2026-102490 and CVE-2026-102489 to the KEV catalog, indicating known exploitation. NVD rates CVE-2026-102490 high severity, with a start date of 2 October 2026. Update Zammad as soon as possible and check the vendor advisory for affected and fixed versions.

By HIFY Radar newsroom Updated 10/26/2026 01:34 PM Get this every day →← Back to the feed 2 sources

HighVulnerabilityExploitation confirmedPatched

In this article

What happened
Why it matters
What to do
For the technical team
Timeline
Sources

What happened

CISA added two flaws in Zammad, a self-hosted support ticketing system, to its Known Exploited Vulnerabilities catalog. That signals known exploitation. NVD rates CVE-2026-102490 high severity.

Why it matters

Zammad holds customer tickets and internal support communications. An exploited flaw can expose that data or halt support operations. Self-hosted instances that have not updated are the target.

What to do

Update Zammad now on every installation, following the vendor security advisories. Prioritize internet-facing instances and confirm the fixed version in the official advisory.

For the technical team

CVE: CVE-2026-102490, CVE-2026-102489
Affected: Zammad GmbH Zammad · Versions not listed in the sources; NVD says to see the vendor advisory and notes versions are not always listed in the KEV feed.
Exploitation: CISA lists CVE-2026-102490 and CVE-2026-102489 in the KEV catalog as exploited; NVD records 2 October 2026 as the start date.
Fix: NVD defers to the vendor advisory for fixed versions. Zammad published security releases in October 2026: 7.2.1 (6 October, critical vulnerabilities), 7.2.2 (8 October, DEB/RPM packages from packager.io only) and 6.5.5 (15 October, emergency fix for the unsupported 6.5 series). The sources do not explicitly map each CVE to a release.
Vector: Component, failure type and exploitation condition are not described in the sources; NVD defers to the vendor advisory. Product: Zammad, a self-hosted helpdesk and ticketing system.
More details: NVD rates CVE-2026-102490 high severity; severity for CVE-2026-102489 is not stated in the sources. In security advisories, Zammad recommends immediate updates for all self-hosted instances. Release 6.5.5 is an emergency fix for customers who cannot immediately upgrade to a supported version.