Zammad, an open-source helpdesk, has a session-hijacking flaw that can be turned into remote code execution as the zammad operating-system user. It is reachable over the network with no prior privileges; CVSS 4.0 rates it 9.4 critical, with passive user interaction, automatable exploitation, and high impact on the application and on subsequent systems. Versions 6.3.0 through 6.5.4 are exploitable. The same flaw is present in 7.0.0 through 7.1.3 but is not exploitable under the environment conditions described in the advisory. CVSS exploit maturity is Attacked (E:A), so exploitation is treated as reported, although the issue is not in CISA KEV and no public proof-of-concept is known.
What to do: Upgrade exploitable 6.3.0–6.5.4 installs to a vendor-patched release newer than 6.5.4, and move 7.0.0–7.1.3 to a release newer than 7.1.3, using the Zammad or DIVD advisory for the exact fixed build rather than assuming a version number. Prioritize internet-facing 6.x systems, because that range is described as exploitable. Until patched, limit external access, invalidate active sessions, and review logs for unexpected activity running as the zammad user.
Affected
Zammad
6.3.0 through 6.5.4 (exploitable)
Zammad
7.0.0 through 7.1.3 (flaw present but not exploitable under the stated environment conditions)
Estimated exposure
moderateon the order of 1,000–10,000 internet-exposed instances (estimate) — No install count or internet-scan total is included in the CVE data; this is an order-of-magnitude estimate from Zammad’s self-hosted helpdesk deployment pattern, which is typically thousands of reachable systems rather than a mass…
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description
Zammad versions 6.3.0 to 6.5.4 are vulnerable a session hijack vulnerability that leads to remote code execution as the zammad user. The vulnerability is also present in version 7.0.0 to version 7.1.3, but not exploitable due to environment conditions.
CISA Known Exploited Vulnerability
Affected
Zammad GmbH Zammad
Required action
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Attackers chained two Zammad zero-days to breach DIVD and steal volunteer researchers' email addresses.
On September 21, attackers breached the Dutch Institute for Vulnerability Disclosure through two zero-days in its Zammad helpdesk, CVE-2026-102489 and CVE-2026-102490. The chain leaked sessions, ran code as the zammad user, and escalated to root within seconds. Stolen data includes volunteer email addresses and possibly other contact details. DIVD said the messy, self-commenting scripts suggest an agentic AI operator and advised all Zammad users to upgrade to version 7 or take systems offline.
Attackers exploited two Zammad zero-days for remote code execution and root, including a breach of DIVD.
Two Zammad zero-days, CVE-2026-102489 and CVE-2026-102490, were exploited in the wild, including against the Dutch Institute for Vulnerability Disclosure on 21 September 2026. CVE-2026-102489 is a session-hijacking flaw in Zammad 6.3.0 through 6.5.4 that can lead to remote command execution as the Zammad service user; the issue also exists in 7.0.0–7.1.3 but researchers said those releases were not exploitable under observed conditions. CVE-2026-102490 is a local privilege escalation to root affecting every version from 1.5.0 through 7.1.0-alpha. Chained, the bugs can yield full server control, ticket and attachment theft, and persistence; DIVD reported the issues on 24 September and recommends upgrading to version 7 or taking systems offline while noting the privilege-escalation bug still affects version 7.
Chained Zammad zero-days let an AI agent breach DIVD, gain root in seconds, and exfiltrate data; users urged to update to version 7.
DIVD, the Dutch Institute for Vulnerability Disclosure, was breached after attackers chained two previously unknown Zammad flaws, CVE-2026-102489 and CVE-2026-102490, in its internal helpdesk platform. The chain enabled session hijacking, remote code execution, and escalation from the Zammad user to root within seconds, accelerated by an autonomous AI agent that executed attack steps without human direction. The attacker pivoted to other services and exfiltrated some data before network segmentation and rapid incident response contained the damage. DIVD urges all Zammad users (over 2,000 customers, 55,000 users) to update to version 7 or take instances offline, and published a script to check logs for abuse.
Attackers used an agentic AI to chain two Zammad zero-days into DIVD's network, hijacking sessions, gaining root, and exfiltrating data on September 21.
The Dutch Institute for Vulnerability Disclosure (DIVD) disclosed that a September 21 attack driven by an agentic AI exploited two Zammad zero-days to hijack sessions, execute code remotely, and escalate from the Zammad user to root, then access other services and exfiltrate data. CVE-2026-102489 is an unauthenticated RCE affecting Zammad 6.3.0-6.5.4; CVE-2026-102490 allows low-privileged authenticated attackers to reach root and affects all versions including the latest alpha; neither had a fix at publication, though CVE-2026-102489 is not exploitable in versions 7.0.0-7.1.3. DIVD reported the incident to the Dutch DPA, NCSC-NL, and police, says network segmentation limited the compromise, and advises Zammad users to upgrade to version 7 or take instances offline.
Attackers exploited two Zammad zero-days to breach DIVD, reach root, and steal volunteer contact data.
The Dutch Institute for Vulnerability Disclosure said attackers exploited two Zammad zero-days after suspicious activity was noticed on September 24. Remote code execution flaw CVE-2026-102489 and elevation-of-privilege flaw CVE-2026-102490, scored 9.4 CVSS when chained, were used to hijack sessions, run code, and escalate from the Zammad user to root within seconds. Attackers then reached other services and exfiltrated data, including volunteer email addresses and possibly contact details. DIVD said script notes in the logs indicate an agentic AI-driven attack and urged every Zammad deployment to update to version 7 or be taken offline.
Attackers exploited two Zammad zero-days in an AI-driven intrusion that hit the Dutch Institute for Vulnerability Disclosure.
The Dutch Institute for Vulnerability Disclosure said it was compromised on September 21, 2026, in what it called an agentic AI-powered attack against its Zammad ticketing system. Attackers chained CVE-2026-102489, an unauthenticated remote code execution and session-leak flaw rated CVSS 9.4, with CVE-2026-102490, a local-to-root privilege escalation also rated 9.4. They pivoted to other services and exfiltrated data, but network segmentation limited deeper access. Zammad 6.3.0 through 6.5.4 are affected; DIVD advises upgrading to version 7 or taking instances offline.
An autonomous AI agent used two Zammad zero-days to breach DIVD, gain root, and exfiltrate data within seconds.
The Dutch Institute for Vulnerability Disclosure says its network was breached by an autonomous AI agent that chained two zero-days in the Zammad helpdesk, CVE-2026-102489 and CVE-2026-102490. The flaws allowed session hijacking, remote code execution, and escalation from the Zammad user to root, after which the attacker reached other services and exfiltrated data within seconds. Segmentation and incident response limited deeper movement, and the investigation is ongoing. Working with Merlon Security, DIVD urges customers to upgrade to Zammad 7 or take vulnerable instances offline; Zammad cites more than 2,000 customers and 55,000 users.
Chained Zammad flaws CVE-2026-102489/102490 enable session hijacking, RCE, and root escalation; already used against DIVD.
DIVD and Merlon Security disclosed two Zammad vulnerabilities, CVE-2026-102489 (session hijacking leading to RCE as the Zammad service user, affecting 6.3.0–6.5.4) and CVE-2026-102490 (local privilege escalation to root, affecting 1.5.0 through 7.1.0-alpha). The chained attack carries a CVSS of 9.4 and was used in a September 21, 2026 intrusion against DIVD's own infrastructure that completed in seconds via an agentic AI-powered workflow. Fixes are included in Zammad 7.2.0; DIVD urges upgrading to version 7 and is scanning for and notifying exposed vulnerable instances.