Zammad Helpdesk on the KEV List: What NYC SMBs Should Do About CVE-2026-102489 and CVE-2026-102490

Open-source helpdesk software is popular for a reason. It is flexible, cost-conscious, and often the first place customers, vendors, and employees leave sensitive tickets. That same convenience is why a publicly reachable helpdesk is not a “nice-to-have web app”—it is an internet-facing business system. When CISA puts a product on the Known Exploited Vulnerabilities (KEV) Catalog, that is not a theoretical research note. It means there is evidence of active exploitation, and defenders should treat patching and triage as urgent work.

On October 2, 2026, CISA announced that it had added two Zammad GmbH vulnerabilities to the KEV Catalog: CVE-2026-102489 (session fixation) and CVE-2026-102490 (improper privilege management). Both were listed with a federal remediation due date of October 5, 2026. That due date has already passed for Federal Civilian Executive Branch agencies under Binding Operational Directive (BOD) 26-04. Private NYC small and midsize businesses are not those agencies—but the operational lesson is the same: if your helpdesk was exposed while these issues were in the wild, inventory, upgrade, and look for compromise before you assume you are fine.

This post is for owners, IT leads, and MSP partners who may be running Zammad (or who inherited an old instance on a cloud VM and forgot it was still live). No exploit recipes—just what CISA and the vendor have published, and a practical checklist you can run this week.

What CISA put on the KEV Catalog

In its October 2, 2026 alert, CISA Adds Two Known Exploited Vulnerabilities to Catalog, CISA stated that both CVEs were added based on evidence of active exploitation:

• CVE-2026-102489 — Zammad GmbH Zammad Session Fixation Vulnerability
• CVE-2026-102490 — Zammad GmbH Zammad Improper Privilege Management Vulnerability

CISA’s KEV Catalog entries (as of this writing) summarize the risk in plain language. For CVE-2026-102489, CISA describes a session fixation vulnerability that can lead to remote code execution as the zammad user, and notes that the issue can be chained with CVE-2026-102490. For CVE-2026-102490, CISA describes improper privilege management that can allow the local zammad user to escalate privileges to root, and notes the same chain in the other direction. Both entries list ransomware campaign use as “Unknown,” flag forensic triage as required under BOD 26-04 for covered federal assets, and set the due date to October 5, 2026.

That chain matter is why this is not a “patch one CVE and move on” story. Session fixation that lands you as the application user, followed by a local privilege escalation to root, is the classic path from a web bug to full host control. CISA also encourages organizations outside the federal civilian branch to adopt risk-based vulnerability management and prioritize KEV remediation—language worth taking seriously even when BOD 26-04 itself does not legally bind your LLC.

What Zammad says about each CVE

Vendor guidance is the mitigation baseline. Zammad’s security advisory for CVE-2026-102489 and CVE-2026-102490 (published October 5, 2026 on zammad.com) frames both issues under DIVD case DIVD-2026-00015 and is the source you should open before you change production.

CVE-2026-102489 — session fixation

According to Zammad’s advisory:

• Exploitation of CVE-2026-102489 is only possible on Zammad 6.5 and earlier, because of the runtime environment those versions use.
• Those releases have been out of support and no longer receive security updates.
• Zammad 7.0 and later are not affected in practice; Zammad notes that DIVD’s own case page also states the vulnerability cannot be exploited under the runtime environment used by those versions.
• As additional hardening, Zammad changed the affected code; that change ships in Zammad 7.2.0.

If you are still on 6.5 or older, you are past end-of-support and sitting on a KEV-listed session fixation path that CISA associates with RCE as the zammad user. Upgrade is not optional housekeeping—it is the fix.

CVE-2026-102490 — local privilege escalation

Zammad’s advisory assessment, after receiving technical details from DIVD, is that CVE-2026-102490 is a local privilege escalation that cannot be exploited remotely on its own. An attacker would need access to the underlying server first, then escalate. Zammad states the issue is related to a confirmed vulnerability in packager.io, and that the team is working on a solution.

That matches the tone of Zammad’s community forum thread Take care: Local Privilege Escalation (CVE-2026-102490) is reported as being actively exploited, where staff reiterated that the LPE is not a standalone remote exploit and urged administrators to update to Zammad 7.2.0 and watch official advisories for further 102490 guidance. Earlier posts in that same thread also walked through the disclosure timeline and recommended immediate upgrades for anyone still on unsupported 6.5-era installs.

Bottom line from the vendor: get off EOL 6.5-, move to current stable (7.2.0 as of the advisory), and restrict who can reach the host while the packager.io-related LPE work continues.

Why an internet-facing helpdesk is a high-value target

Helpdesk systems hold customer PII, password-reset tickets, VPN access requests, invoice disputes, and sometimes screenshots of internal dashboards. Attackers do not need to “hack New York” if they can hijack the place where your staff already trusts session cookies and admin panels. For NYC SMBs—law offices, medical practices, property managers, restaurants with multi-location IT, professional services firms—Zammad (or any similar open-source ticketing stack) often sits on a cheap VPS with a public HTTPS name and thin host hardening.

KEV status changes the priority math. Before KEV, a mid-severity web bug might wait behind quarterly maintenance. After KEV, CISA is telling defenders there is evidence of exploitation in the wild. Combined with CISA’s note that 102489 and 102490 can be chained, a neglected helpdesk VM becomes a plausible beachhead into the same network that holds file shares, email, and RMM agents.

Practical checklist for NYC SMBs and MSPs

Use this as a runbook, not a federal compliance claim. BOD 26-04 applies to FCEB agencies; the checklist borrows its urgency and forensic mindset for private organizations that want the same outcome: reduce exposure and check whether someone already got in.

1. Inventory every Zammad instance. Search DNS, reverse proxies, Kubernetes ingresses, old DigitalOcean/Linode droplets, and MSP-managed client VMs. Include staging and forgotten “temp” installs. Confirm version numbers from the admin UI or package metadata.
2. Classify internet exposure. Is the helpdesk reachable from the whole internet, or only via VPN / IP allowlist / Zero Trust? Public exposure plus EOL software is the emergency lane.
3. Upgrade EOL 6.5 and earlier immediately. Per Zammad, those versions are where CVE-2026-102489 is exploitable in practice, and they no longer receive security updates. Plan the jump to a supported 7.x line, with 7.2.0 carrying the extra session-hardening change called out in the vendor advisory.
4. Treat CVE-2026-102490 as a host-access problem while the vendor finishes the fix. Restrict SSH, sudo, management ports, and deploy pipelines to trusted admins only. If packager.io packaging is in your install path, watch Zammad’s advisory channel for the remediation drop.
5. Rotate sessions and secrets after upgrade. Force logout of agents, rotate application secrets/API tokens where your runbook allows, and review recent admin user creation.
6. Do a light forensic triage—even if you are not a federal agency. CISA’s KEV entries for both CVEs mark forensic triage required under BOD 26-04 for covered federal assets. For private SMBs, that is still good hygiene: review auth logs, unusual process ownership spanning the zammad user, unexpected cron/systemd units, outbound connections from the helpdesk host, and ticket/admin activity around the late-September / early-October disclosure window. If you lack in-house IR capacity, have your MSP or a trusted partner pull a disk/memory snapshot before you wipe and rebuild.
7. Harden the ongoing attack surface. Put the helpdesk behind SSO, MFA for agents, least-privilege roles, WAF / fail2ban style controls where appropriate, automated backups with tested restore, and monitoring that alerts on new local users or privilege changes.
8. Document and schedule. Write down version, host, owner, last upgrade date, and next review. Helpdesk appliances get orphaned faster than firewalls.

How to talk about BOD 26-04 without overclaiming

BOD 26-04 tells federal civilian agencies to prioritize KEV remediation on publicly exposed assets that grant total control post-exploitation, and it sets expectations for checking whether threat actors compromised the system before the patch landed. CISA’s October 2 alert explicitly notes that while BOD 26-04 applies only to FCEB agencies, CISA encourages all organizations to adopt the same risk-based approach.

For an NYC SMB, the useful translation is: if it is on KEV, internet-facing, and can yield host control, treat it like production incident priority—not a backlog ticket. You are not claiming FedRAMP or “BOD compliant.” You are borrowing a prioritization framework that already matches how ransomware crews and opportunistic scanners work.

What MicroSky recommends this week

If you run Zammad—or you are not sure whether a client still does—start with inventory and version truth. Upgrade unsupported 6.5- lines, land on current stable with the 7.2.0 hardening where available, lock down host access while 102490 remediation continues, and spend a few deliberate hours on logs and integrity checks before you declare victory. That is how you turn a KEV headline into a closed risk, instead of a quiet compromise that shows up months later in a ransomware negotiation.

MicroSky helps NYC and Staten Island businesses with managed security, patch prioritization, and incident-minded triage when internet-facing apps suddenly matter more than the quarterly maintenance window. If you want a second set of eyes on a helpdesk host, a client VM inventory, or a short forensic pass after these KEVs, call us at 718-672-2177 or visit https://microskyms.com.

Sources

• CISA — CISA Adds Two Known Exploited Vulnerabilities to Catalog (October 2, 2026): https://www.cisa.gov/news-events/alerts/2026/10/02/cisa-adds-two-known-exploited-vulnerabilities-catalog
• CISA — Known Exploited Vulnerabilities Catalog entries for CVE-2026-102489 and CVE-2026-102490 (date added October 2, 2026; due date October 5, 2026): https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• Zammad — Security Advisory: CVE-2026-102489 and CVE-2026-102490 (October 5, 2026): https://zammad.com/en/advisories/cve-2026-102489-cve-2026-102490
• Zammad Community — Take care: Local Privilege Escalation (CVE-2026-102490) is reported as being actively exploited: https://community.zammad.org/t/take-care-local-privilege-escalation-cve-2026-102490-is-reported-as-being-actively-exploited/21297

Pack note: in-house SA-research (not native Content Genius). Research dated October 8, 2026. Always verify current vendor advisories before you change production systems.