Merlon Security (Organization): news timeline & CVEs

Zammad Vulnerabilities Let Attackers Execute Code and Escalate Privileges to Root

Chained Zammad flaws CVE-2026-102489/102490 enable session hijacking, RCE, and root escalation; already used against DIVD.

DIVD and Merlon Security disclosed two Zammad vulnerabilities, CVE-2026-102489 (session hijacking leading to RCE as the Zammad service user, affecting 6.3.0–6.5.4) and CVE-2026-102490 (local privilege escalation to root, affecting 1.5.0 through 7.1.0-alpha). The chained attack carries a CVSS of 9.4 and was used in a September 21, 2026 intrusion against DIVD's own infrastructure that completed in seconds via an agentic AI-powered workflow. Fixes are included in Zammad 7.2.0; DIVD urges upgrading to version 7 and is scanning for and notifying exposed vulnerable instances.

GBHackers12:44 UTC · 3h agoExploit / PoC in the wild 2 sources CVE-2026-102489 CVE-2026-102490

AI agents hacked the hackers, stealing email addresses from security research org

Attackers chained two Zammad zero-days to breach DIVD and steal volunteer researchers' email addresses.

On September 21, attackers breached the Dutch Institute for Vulnerability Disclosure through two zero-days in its Zammad helpdesk, CVE-2026-102489 and CVE-2026-102490. The chain leaked sessions, ran code as the zammad user, and escalated to root within seconds. Stolen data includes volunteer email addresses and possibly other contact details. DIVD said the messy, self-commenting scripts suggest an agentic AI operator and advised all Zammad users to upgrade to version 7 or take systems offline.

The Register · Securityupdated 08:25 UTC · 8h agofirst Oct 1, 21:26 UTC · 19h agoData breach in the wild 7 sources CVE-2026-102489 CVE-2026-102490

AI agent used Zammad zero-days to breach Dutch vulnerability disclosure non-profit

Attackers used an agentic AI to chain two Zammad zero-days into DIVD's network, hijacking sessions, gaining root, and exfiltrating data on September 21.

The Dutch Institute for Vulnerability Disclosure (DIVD) disclosed that a September 21 attack driven by an agentic AI exploited two Zammad zero-days to hijack sessions, execute code remotely, and escalate from the Zammad user to root, then access other services and exfiltrate data. CVE-2026-102489 is an unauthenticated RCE affecting Zammad 6.3.0-6.5.4; CVE-2026-102490 allows low-privileged authenticated attackers to reach root and affects all versions including the latest alpha; neither had a fix at publication, though CVE-2026-102489 is not exploitable in versions 7.0.0-7.1.3. DIVD reported the incident to the Dutch DPA, NCSC-NL, and police, says network segmentation limited the compromise, and advises Zammad users to upgrade to version 7 or take instances offline.

Help Net Securityupdated 08:25 UTC · 8h agofirst Oct 1, 13:13 UTC · 1d agoData breach in the wild 7 sources CVE-2026-102489

AI Agent Chains Zammad Zero-Days To Take Over DIVD Systems in Seconds

Chained Zammad zero-days let an AI agent breach DIVD, gain root in seconds, and exfiltrate data; users urged to update to version 7.

DIVD, the Dutch Institute for Vulnerability Disclosure, was breached after attackers chained two previously unknown Zammad flaws, CVE-2026-102489 and CVE-2026-102490, in its internal helpdesk platform. The chain enabled session hijacking, remote code execution, and escalation from the Zammad user to root within seconds, accelerated by an autonomous AI agent that executed attack steps without human direction. The attacker pivoted to other services and exfiltrated some data before network segmentation and rapid incident response contained the damage. DIVD urges all Zammad users (over 2,000 customers, 55,000 users) to update to version 7 or take instances offline, and published a script to check logs for abuse.

Security Affairsupdated 08:25 UTC · 8h agofirst Oct 1, 08:04 UTC · 1d agoData breach in the wild 7 sources CVE-2026-102489

DIVD says Zammad zero-days enabled AI-driven network breach

An autonomous AI agent used two Zammad zero-days to breach DIVD, gain root, and exfiltrate data within seconds.

The Dutch Institute for Vulnerability Disclosure says its network was breached by an autonomous AI agent that chained two zero-days in the Zammad helpdesk, CVE-2026-102489 and CVE-2026-102490. The flaws allowed session hijacking, remote code execution, and escalation from the Zammad user to root, after which the attacker reached other services and exfiltrated data within seconds. Segmentation and incident response limited deeper movement, and the investigation is ongoing. Working with Merlon Security, DIVD urges customers to upgrade to Zammad 7 or take vulnerable instances offline; Zammad cites more than 2,000 customers and 55,000 users.

BleepingComputerupdated 08:25 UTC · 8h agofirst Sep 30, 19:49 UTC · 1d agoData breach in the wild 7 sources CVE-2026-102489 CVE-2026-102490

Merlon Security

Timeline5 articles

Related CVEsby mentions

Appears with

Zammad Vulnerabilities Let Attackers Execute Code and Escalate Privileges to Root

AI agents hacked the hackers, stealing email addresses from security research org

AI agent used Zammad zero-days to breach Dutch vulnerability disclosure non-profit

AI Agent Chains Zammad Zero-Days To Take Over DIVD Systems in Seconds

DIVD says Zammad zero-days enabled AI-driven network breach