U.S. CISA adds Zammad GmbH Zammad flaws to its Known Exploited Vulnerabilities catalog

CISA has added two Zammad flaws — CVE-2026-102489 (session hijacking) and CVE-2026-102490 (improper privilege management) — to its Known Exploited Vulnerabilities catalog, citing evidence of active exploitation. Both can lead to remote code execution on the helpdesk platform.