Zammad Zero-Days Enabled AI-Driven Breach of DIVD Network
Summary
DIVD says attackers chained two Zammad zero-days to hijack sessions, execute code, gain root access, and exfiltrate data. Segmentation and response actions limited further movement; users are urged to upgrade to version 7 or take instances offline.
Key points
- DIVD attributes its network breach to two zero-day flaws in the Zammad ticketing system: CVE-2026-102489 and CVE-2026-102490.
- The flaws enabled session hijacking, remote code execution, and escalation from the Zammad user to root.
- An autonomous AI agent reportedly carried out the attack and accessed other services and exfiltrated data within seconds.
- Network segmentation and incident response actions stopped the threat actor from moving deeper into the network; the investigation is ongoing.
- DIVD and Merlon Security notified Zammad; users are advised to upgrade to version 7 or take vulnerable instances offline.
Article Details
- Victim Organization
- Dutch Institute for Vulnerability Disclosure (DIVD)
- Incident Type
- Network breach enabled by chaining two Zammad zero-day vulnerabilities, resulting in session hijacking, remote code execution, and root privilege escalation.
- Operational Impact
- The attacker accessed other services and read and exfiltrated data from DIVD systems. DIVD says network segmentation and incident response prevented the threat actor from moving deeper into the network; the investigation is ongoing.
- Claim Status
- confirmed