Cybersecurity
DIVD says Zammad flaws enabled network breach
The Dutch Institute for Vulnerability Disclosure said its network was breached through two zero-day flaws in Zammad, and that the attacker used automated steps to reach data and root access.
- DIVD said its network breach was possible because attackers chained two zero-day vulnerabilities in Zammad.
- DIVD said an AI agent carried out the attack autonomously and left explanations of its decisions behind.
- The flaws were identified as CVE-2026-102489 and CVE-2026-102490, and DIVD said they enabled session hijacking, remote code execution and root escalation.
- DIVD said the attacker reached other services and exfiltrated data in seconds, but did not move deeper because of network segmentation and incident response actions.
DIVD said the compromise of its network came from two zero-day flaws in Zammad. It said the attack involved an AI agent that acted on its own and left explanations that helped investigators reconstruct what happened.
The nonprofit said the vulnerabilities were now tracked as CVE-2026-102489 and CVE-2026-102490. It said the pair allowed session hijacking, remote code execution and escalation from the Zammad user to root.
DIVD said the attacker then reached other services and took data from its systems. It said those actions happened within seconds because of AI automation.
The organisation said network segmentation and its incident response limited the intruder's progress. It said the investigation was still under way, that it had notified Zammad and was warning other users to upgrade to version 7 or take instances offline.
Named in this story
Companies
- Merlon Security
- worked with DIVD to discover the vulnerabilities
Organisations
- Dutch Institute for Vulnerability Disclosure
- said its network was breached and investigated the incident
Products and systems
- Zammad
- the open-source helpdesk platform whose flaws were exploited
- CVE-2026-102489
- one of the two zero-day flaws DIVD identified
- CVE-2026-102490
- one of the two zero-day flaws DIVD identified
How the source tells it
The register was mostly factual, but it carried urgency and alarm through repeated emphasis on the attack's speed and the quoted description of the incident as messy.
- urgency the attack was repeatedly described as happening in seconds and moving quickly
- alarm the report highlighted root access, data exfiltration and a quoted description of the incident as messy