U.S. CISA adds Zammad GmbH Zammad flaws to its Known Exploited Vulnerabilities catalog

**CISA added two critical Zammad vulnerabilities (CVE-2026-102489 and CVE-2026-102490, both CVSS 9.4) to its Known Exploited Vulnerabilities catalog after the Dutch Institute for Vulnerability Disclosure was breached via chained zero-days that allowed session hijacking to RCE as the 'zammad' user and escalation to root; DIVD reported the attackers used an AI agent to automate the exploit chain and some data was exfiltrated, and Zammad and CISA urge immediate updating to version 7 (or taking instances offline) with a federal mitigation deadline set for October 5, 2026.**