{"apiVersion":"1","notice":"Security Threat Pulse API v1. Free, no key. Facts with sources; verdicts follow the published rules at https://securitythreatpulse.com/methodology. Not advice. Some source data is withheld here until its terms allow re-serving.","generatedAt":"2026-11-11T08:30:28.425Z","products":["zammad"],"actNowTotal":1,"results":[{"query":"zammad","matched":1,"actNow":1,"events":[{"id":"kev-2026-10-02-zammad-gmbh-zammad","url":"https://securitythreatpulse.com/events/kev-2026-10-02-zammad-gmbh-zammad","title":"Zammad: 2 flaws used in attacks; attackers can run their own code","verdict":"act_now","verdictReason":"Attacks are confirmed. The vulnerability is 41 days old, so many systems are likely still unpatched.","tier":"now","rankScore":3,"rankWhy":["Exploitation is confirmed by an authoritative source."],"rulesVersion":"v3","ladder":{"talk":"reported","damage":"none","attempts":"confirmed","exposure":"none","exploited":"confirmed"},"untrackedRungs":["exposure","damage"],"cves":["CVE-2026-102489","CVE-2026-102490"],"vendor":"Zammad GmbH","product":"Zammad","affectedProducts":[{"kind":"direct","slug":"zammad/zammad","vendor":"Zammad","product":"Zammad","evidence":["kev","cpe"],"vendorKey":"zammad","productKey":"zammad"}],"category":{"id":"collaboration","label":"Documents and collaboration","why":"It holds shared documents and internal pages.","doThis":"Patch it, or ask your provider whether they have."},"summary":"Zammad GmbH Zammad contains a session fixation vulnerability that can lead to remote code execution as the zammad user. This vulnerability can be chained with CVE-2026-102490.","cvss":8.7,"epss":0.49915,"exploitMaturity":"poc","kevListed":true,"kevDateAdded":"2026-10-02","kevDueDate":"2026-10-05","firstSeenAt":"2026-10-02T00:00:00.000Z","updatedAt":"2026-11-10T20:00:05.612Z","newestEvidenceAt":"2026-11-10T06:14:35.819Z"}]}]}