Vulnerability intelligence

CVE-2026-102490 is a local privilege escalation vulnerability affecting Zammad, an open-source helpdesk and ticketing system. The flaw is present in all versions of the software, including the latest alpha releases, and allows a local user with access to the `zammad` account to bypass permission checks and escalate their privileges to `root`. This unauthorized access enables the execution of privileged operations, allowing an attacker to modify system files, install software, or access other parts of the host system. The vulnerability was highlighted in reports after being chained with CVE-2026-102489 in an attack against the Dutch Institute for Vulnerability Disclosure (DIVD). In that incident, attackers utilized an autonomous, agentic AI to exploit both flaws, allowing them to hijack sessions, execute code remotely, and escalate privileges to root within seconds. Following evidence of active exploitation in the wild, the Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-102490 to its Known Exploited Vulnerabilities (KEV) catalog, requiring organizations to apply the necessary updates.

CVE-2026-102489 is a session hijacking and remote code execution vulnerability affecting Zammad, an open-source helpdesk and customer support ticketing system. The flaw allows unauthenticated attackers to leak user sessions and remotely execute malicious code as the local `zammad` user. It affects Zammad versions 6.3.0 through 6.5.4 in an exploitable state. While the vulnerability is present in versions 7.0.0 through 7.1.3, environmental conditions prevent its exploitation in those later releases. The vulnerability gained public attention after being exploited as a zero-day alongside CVE-2026-102490, a local privilege escalation flaw, in an automated, agentic AI-powered attack against the Dutch Institute for Vulnerability Disclosure (DIVD) in September 2026. By chaining these two vulnerabilities, the automated agent was able to hijack sessions, execute code, and escalate privileges to root within seconds. To mitigate the issue, users are advised to upgrade to Zammad version 7 or take vulnerable instances offline.

CVE-2026-88772 is a memory overflow vulnerability impacting Citrix NetScaler ADC and NetScaler Gateway appliances. This flaw can result in remote code execution (RCE) or a denial-of-service (DoS) condition. The vulnerability specifically affects appliances where Datagram Transport Layer Security (DTLS) is enabled. DTLS is typically enabled by default for VPN virtual servers, meaning NetScaler Gateway deployments are susceptible unless DTLS has been explicitly disabled. Citrix has confirmed that this vulnerability, alongside CVE-2026-88771, has been actively exploited in unmitigated NetScaler deployments.

CVE-2026-102490 is a local privilege escalation vulnerability affecting Zammad, an open-source helpdesk and ticketing system. The flaw is present in all versions of the software, including the latest alpha releases, and allows a local user with access to the `zammad` account to bypass permission checks and escalate their privileges to `root`. This unauthorized access enables the execution of privileged operations, allowing an attacker to modify system files, install software, or access other parts of the host system. The vulnerability was highlighted in reports after being chained with CVE-2026-102489 in an attack against the Dutch Institute for Vulnerability Disclosure (DIVD). In that incident, attackers utilized an autonomous, agentic AI to exploit both flaws, allowing them to hijack sessions, execute code remotely, and escalate privileges to root within seconds. Following evidence of active exploitation in the wild, the Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-102490 to its Known Exploited Vulnerabilities (KEV) catalog, requiring organizations to apply the necessary updates.

CVE-2026-102489 is a session hijacking and remote code execution vulnerability affecting Zammad, an open-source helpdesk and customer support ticketing system. The flaw allows unauthenticated attackers to leak user sessions and remotely execute malicious code as the local `zammad` user. It affects Zammad versions 6.3.0 through 6.5.4 in an exploitable state. While the vulnerability is present in versions 7.0.0 through 7.1.3, environmental conditions prevent its exploitation in those later releases. The vulnerability gained public attention after being exploited as a zero-day alongside CVE-2026-102490, a local privilege escalation flaw, in an automated, agentic AI-powered attack against the Dutch Institute for Vulnerability Disclosure (DIVD) in September 2026. By chaining these two vulnerabilities, the automated agent was able to hijack sessions, execute code, and escalate privileges to root within seconds. To mitigate the issue, users are advised to upgrade to Zammad version 7 or take vulnerable instances offline.

CVE-2026-76504 is an API authentication bypass vulnerability affecting Cisco Catalyst SD-WAN Manager. The issue arises from the improper handling of URI/URL encoding in HTTP requests. An unauthenticated, remote attacker can exploit this flaw by sending a crafted HTTP request to the affected system's API. This allows the request to bypass an authentication rule designed to restrict access to a specific API endpoint, granting the attacker access to the API with administrative privileges without requiring any credentials. The vulnerability affects Cisco Catalyst SD-WAN Manager regardless of its system configuration. Cisco discovered the issue through a customer support case and confirmed that it is being actively exploited in the wild. Consequently, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-76504 to its Known Exploited Vulnerabilities (KEV) catalog on September 30, 2026. Cisco has released software updates to address the flaw, and because no workarounds are available, organizations are advised to apply the patches to secure their systems.