Zammad Zero-Days Exploited in AI-Powered DIVD Hack

Autonomous AI Agent Breaches DIVD Using Chained Zammad Zero-Days

The Dutch Institute for Vulnerability Disclosure (DIVD), a Netherlands-based nonprofit that coordinates vulnerability disclosure across the security community, disclosed that its own network was breached on September 21, 2026, after an attacker chained two zero-day vulnerabilities in Zammad, the open-source helpdesk and ticketing platform DIVD used internally. Working with Merlon Security, DIVD identified the flaws as CVE-2026-102489 and CVE-2026-102490 — both rated CVSS 9.4 — and said that, used together, they let the intruder hijack active sessions, achieve remote code execution, and escalate privileges from the low-privileged Zammad service account all the way to root, in seconds.

What set the incident apart from a routine breach, according to DIVD, is the attacker itself: the organization assessed that the intrusion was carried out by an autonomous AI agent that selected its own next move after every action, rather than a human operator manually issuing commands. DIVD called the attack "loud and very, very messy," and noted the agent left behind extensive self-generated explanations of its own reasoning — an artifact that, ironically, made reconstructing the incident easier for DIVD's responders.

Incident Details

How the Attack Worked

The Vulnerability Chain

CVE-2026-102489 is an unauthenticated remote code execution flaw that also leaks active user sessions, affecting Zammad versions 6.3.0 through 6.5.4. It allows an attacker with no credentials at all to execute arbitrary code on a vulnerable instance and capture valid session tokens in the process.

CVE-2026-102490 is a local privilege escalation flaw that lets an attacker who already has code execution as the low-privileged zammad service account escalate straight to root on the underlying host. Critically, this flaw affects all known Zammad releases, including the current 7.x line, and has not yet been patched.

Chained together, the two flaws form a complete, end-to-end compromise path: an unauthenticated attacker gains code execution and a valid session on the Zammad instance (CVE-2026-102489), then immediately rides that foothold to root on the host (CVE-2026-102490) — with no further authentication barriers in between.

The Agentic Attack Pattern

DIVD said the behavior it observed did not resemble a human operator working through a playbook. Instead, the attacker moved "automated," deciding its next step after every completed action, at a pace DIVD described as operating "at the speed of light." The organization also noted the agent made mistakes consistent with an AI system still working through its own decision-making, at one point "polluting its own man-in-the-middle attack with password spraying" — combining two distinct techniques in a way that added noise rather than stealth.

That same noisiness worked in DIVD's favor during the investigation. The agent reportedly left verbose, self-narrating comments explaining its own reasoning at each step, which DIVD said made the job of reverse engineering the attack considerably easier than it otherwise would have been.

Lateral Movement and Data Theft

Once it held root on the Zammad host, the attacker pivoted toward other services on DIVD's network and exfiltrated data, which DIVD has identified as including volunteer researcher email addresses and contact details. Network segmentation stopped the intrusion from reaching deeper into DIVD's environment, and the organization says it is continuing to investigate additional signs of compromise, operating on an "assume breach" basis until it can rule out further impact. DIVD has notified Dutch authorities and published a verification script so other Zammad operators can check their own logs for signs of similar abuse.

Impact Assessment

Recommendations

For Zammad Administrators

• Upgrade to Zammad 7 immediately to close CVE-2026-102489. Note that this update does not remediate CVE-2026-102490, the privilege-escalation flaw.
• Because no patch yet exists for CVE-2026-102490, treat self-hosted Zammad instances as high-risk: isolate the host on its own network segment, restrict outbound connectivity from it, and monitor for anomalous process activity under the zammad service account.
• Rotate all session tokens, API keys, and credentials stored in or reachable from the Zammad instance.
• Run DIVD's published verification script against application and web server logs to check for indicators of past abuse.
• Consider taking externally reachable Zammad instances offline until Zammad GmbH ships a fix for CVE-2026-102490.

For Security Teams

• Treat agentic AI tooling as a distinct threat-actor profile — fast and persistent, but also prone to "noisy" tells (redundant technique combinations, inconsistent tradecraft, exposed reasoning) that differ from typical human operator behavior.
• Hunt for patterns such as a man-in-the-middle attempt combined with password spraying against the same target in rapid succession — the specific artifact DIVD flagged as a sign of agentic "sloppy logic."
• Verify that network segmentation genuinely isolates ticketing and helpdesk platforms from core infrastructure; DIVD credited segmentation with preventing a deeper breach.
• Don't assume future agentic attackers will leave the same helpful trail of self-narrated reasoning DIVD benefited from here — build detection that doesn't depend on attacker verbosity.

For the Broader Industry

• Expect more incidents framed as "AI-driven" or "agentic" attacks going forward; validate such claims against concrete technical evidence — logs, exploit chains, and timing — rather than headline framing alone.
• Vulnerability-research and disclosure organizations hold sensitive data on volunteers and reporters, making them high-value targets in their own right; internal tooling at these organizations deserves the same scrutiny normally reserved for client-facing systems.

Key Takeaways

1. DIVD, the Dutch vulnerability-disclosure nonprofit, was breached on September 21, 2026, after an attacker chained two Zammad zero-days — CVE-2026-102489 and CVE-2026-102490 (both CVSS 9.4) — to go from unauthenticated access to root in seconds.
2. DIVD assesses the intrusion was carried out largely autonomously by an AI agent that chose its own next actions after each step, rather than a human operator issuing commands manually.
3. The agent's own mistakes — including mixing a man-in-the-middle attack with password spraying, and leaving verbose self-narrated reasoning behind — helped DIVD reconstruct the attack, but also show agentic attackers can succeed despite "sloppy logic."
4. Upgrading to Zammad 7 closes CVE-2026-102489 but does not fix CVE-2026-102490, the root privilege-escalation flaw, which remains unpatched as of publication.
5. The attacker exfiltrated volunteer researcher contact information and attempted to pivot toward other DIVD services; network segmentation prevented a deeper breach.
6. Zammad is used by more than 2,000 organizations and 55,000+ users, meaning the unpatched privilege-escalation flaw carries broad exposure until Zammad GmbH ships a fix.

Sources

• SecurityWeek — Zammad Zero-Days Exploited in AI-Powered DIVD Hack
• BleepingComputer — DIVD says Zammad zero-days enabled AI-driven network breach
• Help Net Security — AI agent used Zammad zero-days to breach DIVD
• SecurityAffairs — AI Agent Chains Zammad Zero-Days To Take Over DIVD Systems in Seconds