Zammad GmbH CVE debriefs

These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.

Known exploited Zammad GmbH CVE published 2026-10-02

CVE-2026-102490

CVE-2026-102490 is an Improper Privilege Management Vulnerability in Zammad GmbH Zammad. The vulnerability is listed in the CISA Known Exploited Vulnerabilities catalog and is known to be actively exploited. System administrators and security teams should urgently assess exposure and apply vendor-supplied mitigations and CISA guidance to prevent potential privilege escalation and unauthorized access. Affe [truncated]

Known exploited Zammad GmbH CVE published 2026-10-02

CVE-2026-102489

A session fixation vulnerability exists in Zammad GmbH Zammad. This issue allows an attacker to fixate a user's session, potentially leading to unauthorized access. The vulnerability is considered high risk and has been added to the CISA Known Exploited Vulnerabilities catalog. Defenders and administrators of Zammad GmbH Zammad installations should assess exposure and prioritize remediation to prevent pot [truncated]