CISA added two Zammad flaws to KEV on 2 Oct (session fixation CVE-2026-102489; improper privilege management CVE-2026-102490); FCEB due 5 Oct already elapsed. Vendor advisory (5 Oct): 102489 affects 6.5 and earlier in practice; 7.0+ not exploitable in practice, hardening in 7.2.0; 102490 is local privilege escalation (needs prior server access), fix in progress — patch + restrict host access under BOD 26-04. Soft hold: ransomware Unknown; no invented campaigns/IoCs.
CISA added CVE-2026-102489 and CVE-2026-102490 to the Known Exploited Vulnerabilities catalog on 2 Oct 2026 (FCEB due 5 Oct, now elapsed; forensic triage Yes; ransomware Unknown). CISA describes 102489 as session fixation that can lead to remote code execution as the zammad user and 102490 as local privilege escalation to root — the two can be chained. Zammad’s 5 Oct advisory (DIVD-2026-00015): 102489 is exploitable in practice on 6.5 and earlier; 7.0+ not exploitable in practice, with hardening in 7.2.0; 102490 needs prior server access and a permanent fix is still in progress — admins should leave unsupported 6.x and restrict host access. Soft hold: no invented IoCs or Nigerian campaigns; do not claim a shipped permanent fix for 102490. Not a FortiMail or Citrix re-Brief.
Sources: CISA — two Known Exploited Vulnerabilities added (2026-10-02) · Zammad advisory — CVE-2026-102489 / CVE-2026-102490 (2026-10-05) · Soft hold: ransomware Unknown; no invented IoCs/campaigns; 102490 permanent fix still in progress