Another update? A new version, new changes, maybe even a maintenance window — it can be tempting to put it off. After all, the system is still running.

But that is exactly where the risk begins. Especially today, as AI makes it possible to analyze vulnerabilities faster and identify potential attack paths more efficiently. Security advisories such as CVE-2026-102489 and CVE-2026-102490, which affected older Zammad versions, are a clear example of why regular updates and a reliable approach to security fixes matter.

Why Old Versions Become a Security Risk

Software can be running perfectly well from a technical perspective and still pose a security risk. Once a vulnerability has been identified and fixed with a patch, vendors typically publish a corresponding security advisory. While these advisories are intended to give customers transparency, they can also provide attackers with a blueprint: by reverse-engineering patches, they can identify what was fixed and then look for systems where the update has not yet been installed.

Automated Scanning and AI-Assisted Attacks

In the past, weeks could pass between the disclosure of a vulnerability and its active exploitation. Today, automated bots can scan the internet for known patterns within hours. AI can further accelerate this process by helping attackers analyze vulnerabilities and develop exploits more quickly. Organizations that postpone updates for months are therefore taking an unnecessary gamble — and the odds are increasingly stacked against them.

The Overlooked Risk: End of Support Life (EOSL)

Another critical factor is whether a software version has reached its End of Support Life (EOSL). What matters is not only which version is currently in use, but whether that version is still receiving security updates. Each vendor defines which versions are actively supported in its support or release policy. Reviewing this information regularly should therefore be a standard part of update management.

Organizations that continue running the same version for too long risk ending up on a release that is no longer supported. If a vulnerability is discovered later, the vendor will generally no longer provide a security update for that version.

What Good Software Update Management Looks Like

Updates should not become a priority only after a critical vulnerability has already been disclosed. A better approach is to establish a clear process for regularly reviewing new releases, security advisories, and required updates.

That starts with clearly defined responsibilities:

  • Who keeps track of new releases and security advisories?
  • Who assesses how urgent an update is?
  • And who is responsible for making sure it is actually deployed?

Planned maintenance windows, up-to-date backups, and a tested rollback process are just as important in case an update causes unexpected issues. Especially for business-critical systems, updates should be prepared and carried out in a controlled manner rather than under time pressure.

Good update management does not mean installing every new version immediately and without review. What matters is assessing updates on a regular basis, prioritizing security fixes, and making sure the versions in use remain within their supported lifecycle.

IT Security Requires More Than Up-to-Date Software

Keeping software up to date is an important part of maintaining a secure environment, but it is only one piece of the puzzle. Just as important is controlling who has access to a system and how that access is secured.

A good example is CVE-2026-102490, a local privilege escalation vulnerability reported by the Dutch Institute for Vulnerability Disclosure (DIVD). In affected versions, the vulnerability could under certain conditions allow privileges to be escalated at the server level. However, an attacker first needed local access to the affected server; the vulnerability could not be exploited remotely over the network on its own. The case highlights why server access should be restricted to trusted administrators and permissions should consistently follow the principle of least privilege.

A comprehensive security strategy also includes hardening the underlying host system:

  • Isolate services: Separating services, for example through containerization or carefully defined permissions, can prevent an attacker who compromises one service from immediately gaining access to other parts of the system.
  • Keep the entire stack up to date: The underlying operating system, databases, and other dependencies need to be updated consistently as well — not just the application itself.

Traceability is equally important: who made which administrative changes, and when? An audit log can help document security-relevant activity and make unusual behavior easier to investigate. Since version 7.2, Zammad has included a tamper-resistant Admin Audit Logs for exactly this purpose.

Security Is a Shared Responsibility

Security vulnerabilities can never be ruled out entirely in complex software. What matters is how vendors respond when they are discovered. Vulnerabilities need to be assessed quickly, appropriate measures need to be taken, and users need clear, transparent communication.

That means clearly stating which versions are affected, what the actual risk is, and what action users should take. Security advisories should not only provide technical detail, but also give customers clear guidance on what to do next.

A reliable support and release lifecycle is just as important. Organizations need to know how long a version will remain supported and when security updates will stop being provided. Without that transparency, it becomes much harder to plan necessary upgrades in time.

External security researchers and organizations such as the DIVD also play an important role. When vulnerabilities are reported responsibly, vendors should assess them promptly, take appropriate action, and communicate the outcome clearly to their users.

Trust does not come from pretending vulnerabilities never happen. It comes from dealing with them quickly, transparently, and responsibly.

Conclusion: Make Security Part of the Routine

Software security is not a one-time project that can be checked off after installation. It is an ongoing process. Keeping software up to date, hardening the underlying infrastructure, and establishing clear operational processes all work together to reduce the risk of unauthorized access.