Federal cybersecurity regulators have expanded the Known Exploited Vulnerabilities catalog to order priority remediation for two web application flaws in open-source customer support software. Threat actors actively exploit session fixation and privilege manipulation logic to hijack active support agent sessions.
The catalog additions cover Zammad session fixation vulnerability CVE-2026-102489 and improper privilege management vulnerability CVE-2026-102490 under Binding Operational Directive 26-04. Confirmed threat telemetry indicates adversaries issuing crafted HTTP request sequences to fixate user session tokens, allowing unauthenticated attackers to hijack authenticated helpdesk agent sessions and modify role-based access control RBAC parameters across enterprise customer service portals.
Subverting helpdesk and customer support platforms introduces severe data exposure and privilege escalation risks. Because ticketing systems store sensitive customer communications, internal system credentials, and personal data, an unauthenticated session hijack enables threat actors to harvest customer records and manipulate internal access permissions.
– Upgrade Zammad open-source helpdesk installations immediately to current patched maintenance release builds.
– Invalidate active user session tokens and enforce mandatory re-authentication across all helpdesk support accounts.
– Inspect web application access logs for anomalous session identifier tokens or unverified role adjustment calls.
– Enforce strict session token regeneration protocols upon user authentication across all internal web applications.
Customer support platform security relies on robust session lifecycle management and prompt patch execution to ensure helpdesk portals remain protected from unauthenticated session hijacking vectors. #CodeDefence #Zammad #Helpdesk #SessionFixation #PrivilegeEscalation #CISA #KEV #AppSec #PatchManagement
/
