AI Agent Used Two Zammad Zero-Days to Breach DIVD and Exfiltrate Data
Summary
DIVD says an autonomous AI agent exploited two Zammad zero-days to gain root access and exfiltrate data. The nonprofit confirmed volunteer email addresses were stolen; its investigation is ongoing.
Key points
- The breach began on September 21, 2026, when an agent exploited CVE-2026-102489 and CVE-2026-102490 to move from a hijacked session to root access within seconds.
- DIVD detected suspicious activity the next day, blocked access to its data-center systems, and began a forensic investigation with Merlon Security.
- DIVD confirmed exfiltration of volunteers’ email addresses. Contact details may also have been exposed, and the CSIRT ticketing system showed signs of compromise.
- The agent reportedly ran password spraying and a man-in-the-middle attack, and left code comments explaining its actions. DIVD said the investigation was continuing.
- The article recommends upgrading or taking Zammad offline, isolating the helpdesk, preserving logs, rotating credentials, and monitoring for suspicious processes and outbound connections.
- DIVD’s segmentation and response actions limited the agent’s movement through its environment, though they did not prevent the initial data theft.
Article Details
- Victim Organization
- Dutch Institute for Vulnerability Disclosure (DIVD)
- Incident Type
- Intrusion involving chained Zammad zero-day vulnerabilities, session hijacking, remote code execution, privilege escalation to root, credential attacks, and data exfiltration
- Incident Date
- 2026-09-21
- Disclosure Date
- 2026-09-24
- Data Types Exposed
- Volunteers’ DIVD email addresses (confirmed exfiltrated)
- Volunteers’ contact details (possibly exfiltrated)
- CSIRT ticketing emails and replies (partially extracted, according to DIVD)
- Potentially exposed system and research data; investigation ongoing
- Affected Records
- Unknown
- Affected Data Size
- Unknown
- Operational Impact
- DIVD blocked access to all systems in its data center and began a forensic investigation. The compromised helpdesk was a launch point toward other services; network segmentation and response actions limited further movement. The extent of impact across several systems remained under investigation.
- Ransom Or Extortion
- None reported
- Claim Status
- confirmed
MITRE ATT&CK
T1003 · OS Credential DumpingRoot access exposed stored credentials and secrets on the helpdesk host; the article describes potential exposure, not confirmed credential theft.T1021 · Remote ServicesThe compromised Zammad host was used as a launch point to reach other services.T1041 · Exfiltration Over C2 ChannelThe attacker exfiltrated DIVD data after compromising the helpdesk environment.T1059 · Command and Scripting InterpreterAfter code execution, the attacker executed commands and scripts.T1068 · Exploitation for Privilege EscalationThe attacker chained a local privilege-escalation flaw to gain root access.T1078 · Valid AccountsThe initial access involved a hijacked session.T1110 · Brute ForceAfter gaining root access, the attacker conducted password spraying.T1190 · Exploit Public-Facing ApplicationThe attacker exploited an internet-facing Zammad RCE zero-day for initial access.T1557 · Adversary-in-the-MiddleThe attacker conducted a man-in-the-middle attack; its password spraying disrupted that activity.
CVE
Vendors
Products
ConfluenceOther signs of compromise: The project support environment (Jira and Confluence) and system data on IT systems that support DIVD’s operations.GitHub[Organizations / Services ] Systems mentioned as affected or investigated – DIVD, Merlon Security, Google Workspace, Slack, GitHub, GitLabGitLab[Organizations / Services ] Systems mentioned as affected or investigated – DIVD, Merlon Security, Google Workspace, Slack, GitHub, GitLabGoogle Workspace[Organizations / Services ] Systems mentioned as affected or investigated – DIVD, Merlon Security, Google Workspace, Slack, GitHub, GitLabJiraOther signs of compromise: The project support environment (Jira and Confluence) and system data on IT systems that support DIVD’s operations.Slack[Organizations / Services ] Systems mentioned as affected or investigated – DIVD, Merlon Security, Google Workspace, Slack, GitHub, GitLabZammadAn autonomous AI agent breached the Dutch Institute for Vulnerability Disclosure (DIVD) by chaining two zero-day vulnerabilities in Zammad, moving from session hijack to root access in seconds and exfiltrating data.