CVE-2026-102490

Vendor

Zammad GmbH

Product

Zammad

CISA KEV

added 2 Oct 2026, due 5 Oct 2026 (27d overdue)

Weakness

CWE-269

Every item in the archive that references this CVE, highest rank first. Headlines open the publisher.

1. 57
   KEV NVD 30 Sep 2026

   Zammad GmbH Zammad Improper Privilege Management Vulnerability

   Zammad GmbH Zammad contains an improper privilege management vulnerability that can allow the local zammad user to escalate privileges to root. This vulnerability can be chained with CVE-2026-102489.

   KEV · due 5 Oct 2026 (overdue) Fix available CVE-2026-102490 Zammad GmbH
2. 47
   CISA alert CISA 29d ago

   CISA Adds Two Known Exploited Vulnerabilities to Catalog

   CISA has added two new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog , based on evidence of active exploitation. CVE-2026-102489 Zammad GmbH Zammad Session Fixation Vulnerability CVE-2026-102490 Zammad GmbH…

   Exploited CVE-2026-102489CVE-2026-102490