{"total":5,"items":[{"id":483,"title":"[NIEUW] [kritiek] Zammad: Meerdere kwetsbaarheden maken Ausführen von beliebigem Programmcode en privilege-escalatie mogelijk","original_title":"[NEU] [kritisch] Zammad: Mehrere Schwachstellen ermöglichen Ausführen von beliebigem Programmcode und Privilegieneskalation","source_rating":"kritiek","summary":"","ai":false,"actions":[],"url":"https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-3694","type":"advisory","language":"de","published_at":"2026-10-01T11:26:29+00:00","severity":"hoog","priority":45,"vendors":["Zammad"],"cves":[],"cve_count":0,"in_kev":false,"exploited_by":[],"kev_ransomware":false,"cvss_max":null,"epss_max":null,"source_count":1,"ncsc":null,"source":{"slug":"bsi-wid","name":"BSI CERT-Bund WID","category":"overheid","country":"DE","license":"© BSI","reuse":"excerpt"},"bundle":null},{"id":27,"title":"Actief misbruik van zeroday-kwetsbaarheden in Zammad: update nu","original_title":"Actief misbruik van zeroday-kwetsbaarheden in Zammad: update nu","source_rating":null,"summary":"Er zijn twee zeroday-kwetsbaarheden ontdekt in Zammad, een softwareproduct voor klantenservice. De kwetsbaarheden hebben de kenmerken CVE-2026-102489 en CVE-2026-102490. Beide kwetsbaarheden worden actief misbruikt en de kans op misbruik en de mogelijke schade zijn hoog.","ai":false,"actions":[],"url":"https://www.ncsc.nl/alerts/actief-misbruik-van-zeroday-kwetsbaarheden-in-zammad-update-nu","type":"news","language":"nl","published_at":"2026-09-30T18:44:28+00:00","severity":"kritiek","priority":70,"vendors":["Zammad"],"cves":[{"id":"CVE-2026-102489","cvss":9.4,"epss":null,"epss_percentile":null,"in_kev":false,"kev_ransomware":false},{"id":"CVE-2026-102490","cvss":9.4,"epss":null,"epss_percentile":null,"in_kev":false,"kev_ransomware":false}],"cve_count":2,"in_kev":true,"exploited_by":["ENISA EUVD"],"kev_ransomware":false,"cvss_max":9.4,"epss_max":null,"source_count":3,"ncsc":null,"source":{"slug":"ncsc-nl-nieuws","name":"NCSC-NL Nieuws & alerts","category":"overheid","country":"NL","license":"CC0 (Rijksoverheid)","reuse":"open"},"bundle":null},{"id":414,"title":"Kwetsbaarheden aangetroffen in Zammad","original_title":"Kwetsbaarheden aangetroffen in Zammad","source_rating":null,"summary":"Er zijn twee zeroday-kwetsbaarheden aangetroffen in Zammad. De eerste kwetsbaarheid heeft het kenmerk CVE-2026-102489 toegekend gekregen. De kwetsbaarheid stelt een ongeauthenticeerde kwaadwillende op afstand in staat om willekeurige code uit te voeren. De kwetsbaarheid is aanwezig in Zammad versies 6.3.0 tot en met 6.","ai":false,"actions":[],"url":"https://advisories.ncsc.nl/advisory?id=NCSC-2026-0396","type":"advisory","language":"nl","published_at":"2026-09-30T17:31:14+00:00","severity":"kritiek","priority":95,"vendors":["Zammad"],"cves":[{"id":"CVE-2026-102489","cvss":9.4,"epss":null,"epss_percentile":null,"in_kev":false,"kev_ransomware":false},{"id":"CVE-2026-102490","cvss":9.4,"epss":null,"epss_percentile":null,"in_kev":false,"kev_ransomware":false}],"cve_count":2,"in_kev":true,"exploited_by":["ENISA EUVD"],"kev_ransomware":false,"cvss_max":9.4,"epss_max":null,"source_count":3,"ncsc":{"kans":"H","schade":"H"},"source":{"slug":"ncsc-nl-advisories","name":"NCSC-NL Security Advisories","category":"overheid","country":"NL","license":"CC0 (Rijksoverheid)","reuse":"open"},"bundle":null},{"id":516,"title":"CVE-2026-102490: Zammad, actief misbruikt","original_title":"CVE-2026-102490: Zammad, actief misbruikt","source_rating":null,"summary":"All versions of Zammad including the latest alpha enable the local zammad user to escalate privileges to root.","ai":false,"actions":[],"url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-90081","type":"advisory","language":"en","published_at":"2026-09-30T00:00:00+00:00","severity":"hoog","priority":65,"vendors":["Zammad"],"cves":[{"id":"CVE-2026-102490","cvss":9.4,"epss":null,"epss_percentile":null,"in_kev":false,"kev_ransomware":false}],"cve_count":1,"in_kev":true,"exploited_by":["ENISA EUVD"],"kev_ransomware":false,"cvss_max":9.4,"epss_max":null,"source_count":3,"ncsc":null,"source":{"slug":"euvd","name":"ENISA EU Vulnerability Database","category":"vulnerability","country":"EU","license":"ENISA, hergebruik met bronvermelding","reuse":"open"},"bundle":null},{"id":517,"title":"CVE-2026-102489: Zammad, actief misbruikt","original_title":"CVE-2026-102489: Zammad, actief misbruikt","source_rating":null,"summary":"Zammad versions 6.3.0 to 6.5.4 are vulnerable a session hijack vulnerability that leads to remote code execution as the zammad user. The vulnerability is also present in version 7.0.0 to version 7.1.3, but not exploitable due to environment conditions.","ai":false,"actions":[],"url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-90080","type":"advisory","language":"en","published_at":"2026-09-30T00:00:00+00:00","severity":"hoog","priority":65,"vendors":["Zammad"],"cves":[{"id":"CVE-2026-102489","cvss":9.4,"epss":null,"epss_percentile":null,"in_kev":false,"kev_ransomware":false}],"cve_count":1,"in_kev":true,"exploited_by":["ENISA EUVD"],"kev_ransomware":false,"cvss_max":9.4,"epss_max":null,"source_count":3,"ncsc":null,"source":{"slug":"euvd","name":"ENISA EU Vulnerability Database","category":"vulnerability","country":"EU","license":"ENISA, hergebruik met bronvermelding","reuse":"open"},"bundle":null}]}