Zammad (Vendor): news timeline & CVEs

Zammad 0-Day Vulnerabilities Exploited to Gain Remote Code Execution and Root Access

Attackers exploited two Zammad zero-days for remote code execution and root, including a breach of DIVD.

Two Zammad zero-days, CVE-2026-102489 and CVE-2026-102490, were exploited in the wild, including against the Dutch Institute for Vulnerability Disclosure on 21 September 2026. CVE-2026-102489 is a session-hijacking flaw in Zammad 6.3.0 through 6.5.4 that can lead to remote command execution as the Zammad service user; the issue also exists in 7.0.0–7.1.3 but researchers said those releases were not exploitable under observed conditions. CVE-2026-102490 is a local privilege escalation to root affecting every version from 1.5.0 through 7.1.0-alpha. Chained, the bugs can yield full server control, ticket and attachment theft, and persistence; DIVD reported the issues on 24 September and recommends upgrading to version 7 or taking systems offline while noting the privilege-escalation bug still affects version 7.

Cyber Security Newsupdated 12:44 UTC · 3h agofirst 12:17 UTC · 4h agoExploit / PoC in the wild 2 sources CVE-2026-102489 CVE-2026-102490

Two Zero-Days Exploited in Attack on Dutch Institute for Vulnerability Disclosure

Attackers exploited two Zammad zero-days to breach DIVD, reach root, and steal volunteer contact data.

The Dutch Institute for Vulnerability Disclosure said attackers exploited two Zammad zero-days after suspicious activity was noticed on September 24. Remote code execution flaw CVE-2026-102489 and elevation-of-privilege flaw CVE-2026-102490, scored 9.4 CVSS when chained, were used to hijack sessions, run code, and escalate from the Zammad user to root within seconds. Attackers then reached other services and exfiltrated data, including volunteer email addresses and possibly contact details. DIVD said script notes in the logs indicate an agentic AI-driven attack and urged every Zammad deployment to update to version 7 or be taken offline.

Infosecurity Magazine08:25 UTC · 8h agoExploit / PoC in the wild 7 sources CVE-2026-102489 CVE-2026-1024901· 1 read

AI agents hacked the hackers, stealing email addresses from security research org

Attackers chained two Zammad zero-days to breach DIVD and steal volunteer researchers' email addresses.

On September 21, attackers breached the Dutch Institute for Vulnerability Disclosure through two zero-days in its Zammad helpdesk, CVE-2026-102489 and CVE-2026-102490. The chain leaked sessions, ran code as the zammad user, and escalated to root within seconds. Stolen data includes volunteer email addresses and possibly other contact details. DIVD said the messy, self-commenting scripts suggest an agentic AI operator and advised all Zammad users to upgrade to version 7 or take systems offline.

The Register · Securityupdated 08:25 UTC · 8h agofirst Oct 1, 21:26 UTC · 19h agoData breach in the wild 7 sources CVE-2026-102489 CVE-2026-102490

Zammad Zero-Days Exploited in AI-Powered DIVD Hack

Attackers exploited two Zammad zero-days in an AI-driven intrusion that hit the Dutch Institute for Vulnerability Disclosure.

The Dutch Institute for Vulnerability Disclosure said it was compromised on September 21, 2026, in what it called an agentic AI-powered attack against its Zammad ticketing system. Attackers chained CVE-2026-102489, an unauthenticated remote code execution and session-leak flaw rated CVSS 9.4, with CVE-2026-102490, a local-to-root privilege escalation also rated 9.4. They pivoted to other services and exfiltrated data, but network segmentation limited deeper access. Zammad 6.3.0 through 6.5.4 are affected; DIVD advises upgrading to version 7 or taking instances offline.

SecurityWeekupdated 08:25 UTC · 8h agofirst Oct 1, 10:42 UTC · 1d agoExploit / PoC in the wild 7 sources CVE-2026-102489 CVE-2026-102490

DIVD says Zammad zero-days enabled AI-driven network breach

An autonomous AI agent used two Zammad zero-days to breach DIVD, gain root, and exfiltrate data within seconds.

The Dutch Institute for Vulnerability Disclosure says its network was breached by an autonomous AI agent that chained two zero-days in the Zammad helpdesk, CVE-2026-102489 and CVE-2026-102490. The flaws allowed session hijacking, remote code execution, and escalation from the Zammad user to root, after which the attacker reached other services and exfiltrated data within seconds. Segmentation and incident response limited deeper movement, and the investigation is ongoing. Working with Merlon Security, DIVD urges customers to upgrade to Zammad 7 or take vulnerable instances offline; Zammad cites more than 2,000 customers and 55,000 users.

BleepingComputerupdated 08:25 UTC · 8h agofirst Sep 30, 19:49 UTC · 1d agoData breach in the wild 7 sources CVE-2026-102489 CVE-2026-102490

Zammad

Timeline5 articles

Related CVEsby mentions

Appears with

Zammad 0-Day Vulnerabilities Exploited to Gain Remote Code Execution and Root Access

Two Zero-Days Exploited in Attack on Dutch Institute for Vulnerability Disclosure

AI agents hacked the hackers, stealing email addresses from security research org

Zammad Zero-Days Exploited in AI-Powered DIVD Hack

DIVD says Zammad zero-days enabled AI-driven network breach