4 min read · 1,055 words
This article was written with AI. It was drafted from the sources it cites and checked against the full text of those sources before publishing. How we make articles
Two Zammad Zero-Days, One AI Agent: DIVD Breached in Seconds
On September 21, 2026, attackers breached the Dutch Institute for Vulnerability Disclosure (DIVD) through two previously unknown flaws in Zammad, the open-source ticketing platform its incident-response team used (Hackread). The victim is a nonprofit of volunteer security researchers that scans the internet for vulnerable systems and notifies their owners (BleepingComputer). DIVD says the two flaws, used together, let the attackers “hijack sessions, run code remotely, and escalate privileges from the Zammad user to root, in seconds, due to the agentic part of this hack” (BleepingComputer).
That last clause is why the case matters beyond one helpdesk product. DIVD called it “an attack we have not seen before,” adding that “the modus operandi indicates that this is an agentic AI-powered attack” (BleepingComputer). BleepingComputer writes that the organization “said it had been hacked after seven years of uneventful operations” (BleepingComputer).
What the Defenders Watched
DIVD’s own account, as Help Net Security reported it: “We could see the agent working automated, because after every action it decided the next step itself, at the speed of light and sloppy logic or pattern” (Help Net Security). The agent was fast, and it was not careful. DIVD said it “has done some pretty dumb things, like polluting its own MITM attack with password spraying,” and called the attack “loud and very very messy” (Help Net Security).
The mess helped the defenders. In DIVD’s words, the agent “is so overexplaining in its comments that it makes our job in reverse engineering a lot easier” (Help Net Security). BleepingComputer describes the same thing from the outside: the agent “left behind clear explanations of its decisions, allowing the organization to reconstruct the incident” (BleepingComputer).
Timeline: Five Days From Breach to Notification
Hackread reports that DIVD “detected suspicious activity the following day, blocked access to its data-centre infrastructure and began a forensic investigation with incident-response company Merlon Security” (Hackread). It also reported the incident to the Dutch Data Protection Authority and the National Cyber Security Centre, and discussed its options with the police (Help Net Security).
BleepingComputer reports that DIVD “discovered the zero-day vulnerabilities in collaboration with Merlon Security” (BleepingComputer). According to the case file, the vulnerability was analysed and reproduced on 22 and 23 September and reported to Zammad on 24 September. On 26 September DIVD scanned for publicly available vulnerable instances, created a limited disclosure for both CVEs and started notifying owners (DIVD).
Count the gap: September 21 to September 26 is five days from intrusion to the first notifications (26 − 21 = 5).
Analysis: the two clocks in this case are not the same size. In agentic cyber attacks the attacker’s share of the timeline is machine time, and the defender’s share is still human time.
How Two Flaws Become Root
Two links make the chain. The case file describes CVE-2026-102489 as a session hijack vulnerability in Zammad 6.3.0 to 6.5.4 “that leads to remote code execution as the zammad user,” and CVE-2026-102490 as one that “enables the local zammad user to escalate privileges to root” (DIVD). Hackread reports a CVSS score of 8.7 for the first (Hackread).
Inception Security reports that “CISA added both to the KEV catalog on 2 October 2026, with a due date of 2026-10-05 and forensic triage required” (Inception Security). It puts two questions to any operator: “Do you run Zammad, on which version, and can the internet reach it? And if the zammad account became root tonight, would any log leave the box to tell you?” (Inception Security).
After the chain ran, BleepingComputer reports, the attacker “was able to access other services, read and exfiltrate data from DIVD’s systems” (BleepingComputer). Help Net Security notes that DIVD “has yet to share which data was accessed by the AI agents and why” (Help Net Security). Segmentation and incident response kept the intrusion from spreading: “We were able to stop the attackers from going deeper into our systems and network,” DIVD said (Help Net Security).
Where Vendor and Victim Stand
Zammad’s community post gives the vendor’s assessment: “Zammad 7.0 and later are not affected by CVE-2026-102489 in practice,” and CVE-2026-102490 “is a local privilege escalation issue and cannot be exploited remotely on its own” (Zammad Community). DIVD’s case file says the first flaw is also present in versions 7.0.0 to 7.1.3 “but not exploitable due to environment conditions,” and lists the privilege escalation as affecting v1.5.0 to v7.1.0-alpha (DIVD).
On remedies the two line up. DIVD advises all users “to upgrade to version 7 of Zammad or to take it offline” (DIVD), and Zammad recommends “updating to Zammad 7.2.0 and restricting server access to trusted administrators” (Zammad Community).
How many organizations does that touch? BleepingComputer describes Zammad as “an open-source AI-powered helpdesk and support ticketing platform used to manage customer inquiries, IT support requests, and internal ticketing,” and notes that the company claims on its website to have over 2,000 customers and 55,000 users (BleepingComputer).
DIVD’s posture on its own network is blunter than any version table: “We’ve found signs of compromise that we’re still looking into, and until we can prove otherwise we assume breach” (Help Net Security).
What to Check Before the Next Update
On this article’s reading, the order of work for a Zammad administrator follows from those sources:
- Inventory every instance against the case file’s ranges. Versions 6.3.0 to 6.5.4 are where DIVD says the remote flaw is exploitable (DIVD).
- Upgrade, or take the instance offline. That is DIVD’s advice, and Zammad names 7.2.0 as the target (DIVD, Zammad Community).
- Keep the logs before patching over them. The case file offers a log check script “to check your Zammad logfiles for Indicators of Compromise” (DIVD).
- Hunt afterwards. Inception Security has published a hunt for the session-hijack-to-root chain across both CVEs (Inception Security).
The case file was still marked open when it was last modified on October 1 (DIVD). Whether the breach was part of a larger attack or a test of what agentic cyber attacks can do is, in Help Net Security’s word, “unknown” (Help Net Security).