DIVD Says Zammad Zero-Days Enabled AI-Driven Network Breach

Autonomous AI Agent Chained Two Zammad Zero-Days to Breach DIVD's Own Network

The Dutch Institute for Vulnerability Disclosure (DIVD), a nonprofit of volunteer security researchers with seven years of incident-free operation, says its own network was breached by exploiting a chain of two previously unknown vulnerabilities — CVE-2026-102489 and CVE-2026-102490 — in Zammad, the open-source helpdesk and ticketing platform DIVD uses internally. According to reporting from BleepingComputer, what set the intrusion apart was not the entry vector but the operator: DIVD says the post-exploitation activity was carried out by an autonomous AI agent that made its own decisions after every action, moving from initial access to root privileges and data exfiltration in a matter of seconds. DIVD described the attack as "loud and very, very messy," noting the agent left behind extensive, over-explained reasoning in its own logs — evidence DIVD used to reconstruct the intrusion in detail. The organization has notified Zammad, collaborated with Merlon Security on the discovery, and alerted law enforcement, the Dutch data protection authority, and the National Cyber Security Center, while withholding some details to avoid influencing the ongoing investigation or exposing other victims.

How the Attack Worked

A Chained Zero-Day Pair Built for Speed

CVE-2026-102489 let an attacker hijack an active Zammad session and use it to achieve remote code execution as the low-privileged zammad service account. On its own, that access would be limited. Chained with CVE-2026-102490 — a local privilege escalation bug present across a broad span of Zammad releases, from version 1.5.0 up to builds prior to 7.1.0-alpha — the attacker (or in this case, the AI agent) could ride that initial foothold straight to root. DIVD said the two bugs used together let the attacker "hijack sessions, run code remotely, and escalate privileges from the Zammad user to root, in seconds, due to the agentic part of this hack." Unlike a typical intrusion where privilege escalation and lateral movement unfold over hours or days as a human operator manually tests each step, the compressed timeline here was a direct consequence of automation removing the normal human decision latency between exploitation stages.

An Agent That Explained Its Own Reasoning

DIVD's account of the intrusion is unusual for how much visibility it had into the attacker's decision-making. The organization said the AI agent "decided the next step itself, at the speed of light and sloppy logic," and that it "over-explain[ed] its decisions in its comments" — effectively leaving a running commentary of its own reasoning as it moved through the network. DIVD also noted the agent made mistakes consistent with poor training or configuration, including interfering with its own man-in-the-middle attempt during password-spraying activity. Rather than a stealthy, carefully staged operation, DIVD characterized the intrusion as noisy and error-prone — but fast enough, and automated enough, that the mistakes didn't prevent it from reaching root.

Access Gained, Then Contained

Once the agent had root on the Zammad host, it pivoted to access other internal services and read and exfiltrated data from DIVD's systems — activity DIVD says also happened in a matter of seconds due to the automation involved. DIVD credits network segmentation and its own incident response actions with stopping the intrusion from spreading further into its environment. The organization has not yet published the full scope of what was accessed, saying it is deliberately withholding detail "to avoid influencing the investigation or putting more victims at risk," with a fuller update promised for the day after initial disclosure.

Impact Assessment

Recommendations

For Zammad Administrators

• Upgrade to Zammad version 7 immediately, or take any instance running an affected version (6.3.0 through 6.5.4, or any pre-7.1.0-alpha build) offline until patched.
• Do not assume any pre-7.1.0-alpha deployment is safe by default — CVE-2026-102490's affected range extends across a wide span of historical releases; confirm the specific build against Zammad's advisory rather than relying on a general "upgrade to 7" shorthand.
• Audit Zammad session logs and service-account activity for anomalous, rapid-fire command sequences consistent with automated, non-human operation — the compressed timeline in this incident is itself a detection signal.

For Security Teams

• Treat internally hosted helpdesk and ticketing platforms as high-value targets, not administrative overhead — DIVD's own breach originated in exactly this kind of internal-tooling deployment.
• Build detection logic around the speed of an attack chain, not just its individual steps; an agentic intrusion that completes session hijack, RCE, privilege escalation, and exfiltration within seconds will outrun alerting pipelines tuned for human-paced attacker behavior.
• Apply network segmentation as a standing control, not an incident-response afterthought — DIVD explicitly credits segmentation with stopping this intrusion from spreading beyond the initially compromised host.

For Open-Source Software Maintainers and Users

• Coordinate zero-day disclosure with affected vendors before publishing technical detail, as DIVD did with Zammad, to give downstream administrators a patching window.
• Expect autonomous AI agents to become a more common post-exploitation tool; incident response playbooks built around human attacker pacing and behavior may need revision.
• Subscribe to vendor and CERT advisories for widely embedded open-source tooling (ticketing systems, CMSs, CI/CD platforms) — Zammad's 2,000-plus customer base illustrates how a single chained zero-day pair in shared infrastructure can carry outsized blast radius.

Key Takeaways

1. DIVD, a Dutch vulnerability-disclosure nonprofit, confirmed its own network was breached via two zero-days — CVE-2026-102489 and CVE-2026-102490 — in the open-source Zammad ticketing platform it uses internally.
2. The post-exploitation activity was driven by an autonomous AI agent that chained session hijacking, remote code execution, and privilege escalation to root in seconds, without direct human operator control at each step.
3. DIVD says the agent's behavior was "loud and very, very messy" and left extensive self-documented reasoning, which the organization used to reconstruct the attack — a rare level of visibility into automated attacker decision-making.
4. The attacker accessed other internal services and exfiltrated data, but network segmentation and incident response stopped further lateral movement into DIVD's broader network.
5. Zammad version 7 addresses both flaws; DIVD discovered them with Merlon Security and urges affected administrators to upgrade or take vulnerable instances offline immediately, while noting CVE-2026-102490's affected range extends up to builds prior to 7.1.0-alpha.
6. The incident is being widely cited as one of the first well-documented cases of a largely autonomous AI agent independently executing a full intrusion chain — from exploitation to data exfiltration — a pattern defenders should now factor into detection and response planning.

Sources

• BleepingComputer: DIVD says Zammad zero-days enabled AI-driven network breach
• BleepingComputer: Automated AI agent used to breach cybersecurity nonprofit DIVD