On October 2, 2026, CISA added two Zammad vulnerabilities to the Known Exploited Vulnerabilities catalog — CVE-2026-102489 and CVE-2026-102490 — with a federal remediation due date of October 5, 2026. Public reporting characterizes CVE-2026-102489 as a serious issue affecting older Zammad lines; CVE-2026-102490 as a local privilege-escalation concern tied to packaging. Zammad published its assessment under advisory coverage of DIVD case DIVD-2026-00015. If you self-host Zammad (or inherited a customer appliance that still runs it), helpdesk is not "just tickets." It holds PII, auth callbacks, mailbox credentials, and often SSO into the rest of your estate. A KEV on that box is a SaaS availability and trust event.
What Zammad says vs what CISA listing forces you to do
Zammad's October 5, 2026 advisory states that CVE-2026-102489 is exploitable in practice on Zammad 6.5 and earlier because of the runtime environment those releases used, and that those releases are out of support. Zammad 7.0 and later are described as not affected in practice; as additional hardening, affected code changes shipped in Zammad 7.2.0 . For CVE-2026-102490, Zammad describes a local privilege-escalation issue that cannot be exploited remotely on its own — an attacker would already need server access — and notes ongoing work related to packager.io packaging. CISA's KEV listing still creates a compliance clock for federal agencies and a buyer expectation for everyone else. Do not argue with your auditor using only "7.0 is fine in practice" if you are still on 6.x. Move first; debate nuance second.
Upgrade and hardening checklist
1. Version truth. Read the exact Zammad version from the admin UI and package metadata. Screenshots beat memory. 2. Leave unsupported 6.x. Plan a maintenance window to a supported 7.x line. Prefer landing on 7.2.0 or newer so you pick up the hardening Zammad called out for CVE-2026-102489. 3. Server perimeter. SSH and panel access only from break-glass networks. Local PE bugs matter less when random contractors cannot reach the host — and matter a lot when they can. 4. Secrets rotation after exposure windows. If the instance was internet-exposed on a vulnerable 6.x build during the KEV window, rotate mailbox passwords, OAuth client secrets, and API tokens after upgrade. 5. Backup restore drill. Helpdesk upgrades fail messily when Elasticsearch/DB plugins drift. Restore to staging first. 6. Customer communication. Agencies and mid-market buyers will ask whether your support tooling was on KEV. Have a one-pager ready.
Zammad KEV checklist (CVE-2026-102489 / CVE-2026-102490)
[ ] Confirm exact version (admin UI + package)
[ ] If ≤6.5: emergency upgrade off unsupported line
[ ] Target ≥7.2.0 for hardening noted in vendor advisory
[ ] Lock host admin access; review sudo / deploy users
[ ] Rotate mailbox + OAuth + API secrets if exposure suspected
[ ] Staging restore drill before production cutover
[ ] Evidence pack for security questionnairesFounder takeaway
Zammad's October 2026 KEV entries are a reminder that self-hosted helpdesk is Tier-0 infrastructure. Leave unsupported 6.5 and earlier, move toward 7.2.0+ hardening, restrict server access, and treat ticket systems with the same KEV seriousness you give production app servers. SaaS companies that patch the customer-facing API while leaving support tooling on abandoned majors are one phishing-assisted host login away from a very public incident.
Why helpdesk is Tier-0
Zammad stores customer PII, attachments, and often mailbox credentials that can reset every other system. Attackers who land on an old helpdesk box frequently pivot via those mailboxes. Treating CVE-2026-102489 as "just another app CVE" misses the blast radius. If you run Zammad in Docker/Kubernetes, confirm the image tag and the host package story for CVE-2026-102490-style local issues. Containerizing the app does not remove host privilege-escalation concerns if operators SSH in with broad sudo.
Cloud-hosted Zammad customers should still ask the vendor or operator which version they are on and whether any KEV mitigations were applied during the October 2–5 window. Shared responsibility cuts both ways.
Migration gotchas worth budgeting
Major-version Zammad upgrades can require Elasticsearch reindexing, channel re-auth, and custom object migrations. Do not schedule the KEV jump on the same day as a marketing launch. Stage a production-sized restore, time the cutover, and keep a rollback snapshot.
After upgrade, review admin users, API tokens, and trigger scripts that shell out. Local PE and residual webshells are how "we patched" becomes "we patched but they stayed."
Operationally, assign a single owner for this topic inside your company calendar this month. Put the primary-source links in the ticket, schedule the verification steps above, and refuse to close the ticket until evidence (version strings, screenshots, or policy exports) is attached. Teams that "align in Slack" without artifacts rediscover the same gap on the next questionnaire or the next KEV weekend. CodeFlamme's bias is simple: dated owners, primary sources, and reversible changes beat heroic fire drills.
Operationally, assign a single owner for this topic inside your company calendar this month. Put the primary-source links in the ticket, schedule the verification steps above, and refuse to close the ticket until evidence (version strings, screenshots, or policy exports) is attached. Teams that "align in Slack" without artifacts rediscover the same gap on the next questionnaire or the next KEV weekend. CodeFlamme's bias is simple: dated owners, primary sources, and reversible changes beat heroic fire drills.
Operationally, assign a single owner for this topic inside your company calendar this month. Put the primary-source links in the ticket, schedule the verification steps above, and refuse to close the ticket until evidence (version strings, screenshots, or policy exports) is attached. Teams that "align in Slack" without artifacts rediscover the same gap on the next questionnaire or the next KEV weekend. CodeFlamme's bias is simple: dated owners, primary sources, and reversible changes beat heroic fire drills.
