Zammad and Atlassian October 2026 KEV response: select fixes by release and installation method

What it is

Status as of 25 October 2026. CISA added Zammad CVE-2026-102489 and CVE-2026-102490 to KEV on 2 October, and Atlassian CVE-2026-21589 on 15 October 2026. This article uses Zammad's 15 October release notice and privilege advisory published 8 October, plus Atlassian's advisory last modified 5 October 2026. Re-check release notices, repository migration requirements and KEV actions before declaring remediation complete.

Zammad 6.5.5 provides an exceptional fix for CVE-2026-102489 in its unsupported 6.5 series. The vendor recommends 7.2.2 where migration is possible. For CVE-2026-102490, its newer advisory lists packager.io DEB/RPM installations through 7.2.1 as affected and 7.2.2 as fixed; source installations and official container images are excluded. This local privilege flaw requires an existing service-account foothold.

Atlassian's flaw permits unauthenticated access to specific files in the affected application's web root. Its advisory distinguishes self-hosted installations from affected cloud products, which it says were already patched without customer action.

Why it matters

A reachable login page is not evidence that an unauthenticated flaw is contained. Likewise, upgrading an application does not establish that an earlier server compromise has been removed. Maintain separate records for vulnerability closure, access restrictions and incident investigation.

The following workflow is a proposed operator checklist. It prioritises supported updates and preservation of evidence rather than probing for exploitability.

How to apply

• Inventory each installation. Record product, runtime, package method, version and every reachable backend or cluster node. For packaged Zammad installations, dpkg-query -W zammad or rpm -q zammad provides package evidence; compare it with the running application's version. Check owned ingress rules and approved external reachability observations without sending exploit requests.
• Update Zammad with the correct repository. Prefer the supported 7.2.2 upgrade or a later vendor-confirmed release. If that migration is temporarily unavailable for a 6.5 installation, follow the repository-migration instructions linked in the 6.5.5 notice before updating: the emergency release is available only from the new repository. Preserve recoverable database and attachment backups. The 6.5.5 notice addresses CVE-2026-102489; do not treat it as separate proof of closure for CVE-2026-102490.
• Use Atlassian's complete fixed-release list. Select the appropriate supported train; do not interpret a fix in one train as covering another:

Product	Vendor-listed fixed versions
Bitbucket Data Center	9.4.26; 10.2.8; 10.5.1
Confluence Data Center	9.2.26; 10.2.19
Jira Service Management Data Center	5.12.40; 10.3.26; 11.3.12
Jira Software Data Center	9.12.40; 10.3.26; 11.3.12
Bamboo Data Center	10.2.24; 12.1.12
Crowd Data Center	6.3.7; 7.0.3; 7.1.7; 7.2.4
Crucible	4.9.15
Fisheye	4.9.15

• Contain while updating. Restrict public reachability if the required upgrade cannot be completed immediately. Apply any vendor interim configuration only to its documented product and verify every ingress path. Keep an expiry and update owner for temporary restrictions.
• Investigate and verify. Preserve application and proxy access logs; Atlassian provides access-log investigation guidance. Review unexpected accounts, configuration changes and privileged host activity as investigation leads. Record the running version on every node after updating, then test login, attachments and required integrations. If evidence establishes host compromise, preserve it, rebuild from trusted media and rotate exposed service credentials from a clean system.

Pitfalls

An indicator search without matches cannot establish integrity when logs are incomplete. Zammad's emergency release does not restore support for the 6.5 series. Do not restore a suspected compromised installation wholesale into the replacement. Keep Zammad's two CVEs and Atlassian's per-product updates as distinct acceptance decisions.