Cyber

What changed

Zammad GmbH has disclosed two significant vulnerabilities in its Zammad product, specifically a session fixation vulnerability (CVE-2026-102489) and an improper privilege management vulnerability (CVE-2026-102490). These vulnerabilities have been added to CISA's Known Exploited Vulnerabilities Catalog due to evidence indicating active exploitation in the wild.

• CVE-2026-102489: Session Fixation Vulnerability
• CVE-2026-102490: Improper Privilege Management Vulnerability
• Both vulnerabilities pose a risk of unauthorized access and privilege escalation.

Who is affected

Organizations utilizing Zammad for customer support and ticketing systems are at risk due to these vulnerabilities. The potential impact could compromise sensitive user data and system integrity.

• Zammad GmbH's Zammad product users
• Businesses relying on Zammad for customer service operations
• IT departments managing Zammad installations
• Any organization that integrates Zammad with other systems

What to do

Immediate action is recommended for all users of Zammad to mitigate the risks associated with these vulnerabilities. Organizations should prioritize updates and apply security patches as they become available.

• Monitor CISA and Zammad's official channels for updates and patches.
• Conduct a security audit of Zammad implementations to assess exposure.
• Implement additional security measures, such as session management best practices.
• Educate staff on the risks associated with session fixation and privilege management.

What changed

Recent findings reveal that Kali365 has been leveraging vulnerabilities in Microsoft device login processes to obtain OAuth tokens. This exploitation allows attackers to gain unauthorized access to sensitive corporate data, particularly targeting organizations in the United States.

The implications of this activity are severe, as it not only compromises individual accounts but also potentially exposes entire corporate networks to further attacks.

• Exploitation of Microsoft device login mechanisms.
• Unauthorized access to OAuth tokens.
• Targeting of US corporate data.

Who is affected

Organizations utilizing Microsoft device login for authentication are at risk. This includes various sectors such as finance, healthcare, and technology, which often rely on OAuth for secure access.

Additionally, any company that has integrated Microsoft services into their operations may be vulnerable to these phishing attacks.

• US corporations using Microsoft device login.
• Financial institutions relying on OAuth tokens.
• Healthcare organizations with sensitive data.
• Technology firms integrating Microsoft services.

What to do

Security Operations Center (SOC) teams should enhance their monitoring and detection capabilities to identify signs of unauthorized access stemming from these exploits. Implementing multi-factor authentication (MFA) can also mitigate risks associated with compromised OAuth tokens.

Regular training on phishing awareness for employees is crucial to reduce the likelihood of successful attacks.

• Enhance monitoring for unauthorized access attempts.
• Implement multi-factor authentication (MFA).
• Conduct regular phishing awareness training for employees.
• Review and strengthen incident response protocols.