# CISA Sets Zammad Remediation Deadline

CISA added Zammad vulnerabilities CVE-2026-102489 and CVE-2026-102490 to its Known Exploited Vulnerabilities catalog on October 2, 2026, and set October 5, 2026, as the remediation deadline for federal civilian agencies under Binding Operational Directive 26-04. Agencies and contractors operating Zammad should update to version 7.2.0, assess exposure, and conduct forensic triage; the signal identifies no contract or solicitation opportunity.

- Federal civilian agencies are required to remediate by **October 5, 2026 (today)** under the directive.
- Contractors operating or supporting Zammad in government environments should assess affected systems, apply version 7.2.0, and conduct forensic triage to support agency remediation.
- This development is relevant to contractors responsible for software operations and cybersecurity because exploited vulnerabilities may require immediate coordination with federal agency customers.

**Jurisdictions:** federal
**Industries:** Information Technology, Public Safety
**Topics:** Cybersecurity, Regulatory Compliance
**Published:** October 05, 2026

### Government Entities
- Cybersecurity and Infrastructure Security Agency (CISA)

### Vendors
- Zammad (Software publisher)

### Sources
- [CISA Warns of Zammad DIVD Vulnerabilities Actively Exploited in Attacks](https://cybersecuritynews.com/zammad-divd-vulnerabilities-exploited/amp) - CyberSecurityNews