AI agent used Zammad zero-days to breach Dutch vulnerability disclosure non-profit
Attackers used an agentic AI to chain two Zammad zero-days into DIVD's network, hijacking sessions, gaining root, and exfiltrating data on September 21.
The Dutch Institute for Vulnerability Disclosure (DIVD) disclosed that a September 21 attack driven by an agentic AI exploited two Zammad zero-days to hijack sessions, execute code remotely, and escalate from the Zammad user to root, then access other services and exfiltrate data. CVE-2026-102489 is an unauthenticated RCE affecting Zammad 6.3.0-6.5.4; CVE-2026-102490 allows low-privileged authenticated attackers to reach root and affects all versions including the latest alpha; neither had a fix at publication, though CVE-2026-102489 is not exploitable in versions 7.0.0-7.1.3. DIVD reported the incident to the Dutch DPA, NCSC-NL, and police, says network segmentation limited the compromise, and advises Zammad users to upgrade to version 7 or take instances offline.
- Agentic AI attack hit DIVD on September 21 via two Zammad zero-days
- CVE-2026-102489: unauthenticated RCE in Zammad 6.3.0-6.5.4; CVE-2026-102490: root privilege escalation in all versions
- Both flaws lacked fixes at publication; users advised to upgrade to Zammad 7 or go offline
- Network segmentation and incident response limited the compromise, but DIVD assumes breach
Vulnerabilities mentionedAll →
- CVE-2026-1024899.4<1%Session hijack to RCE in Zammadpublished · Zammad KEV+1 related
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
CVE-2026-102489+1 related CVE |
Full article692 words · extracted from helpnetsecurity.com · click to collapse
An agentic AI-powered attack that hit the Dutch Institute for Vulnerability Disclosure (DIVD) on September 21 exploited two zero-day vulnerabilities in Zammad, an open-source helpdesk and customer support ticketing system.
“Used together, [the two flaws] allowed the attackers to hijack sessions, run code remotely and escalate privileges from the Zammad user to root, in seconds, due to the agentic part of this hack. From there they were able to access other services and read and exfiltrate data,” the Dutch non-profit shared on Wednesday.
The DIVD breach
DIVD is an organization staffed with (predominantly) volunteer security researchers. It searches for new vulnerabilities in software and report them to the vendors, scans the internet for known vulnerabilities, and notifies owners of vulnerable systems via hosting providers, national CERTs or other intermediaries.
A week ago, its computer security incident response team (CSIRT) revealed that it got hacked and that it started an investigation after reporting the incident to the Autoriteit Persoonsgegevens (the Dutch Data Protection Authority), the Dutch National Cyber Security Centre (NCSC-NL), and discussing their options with the police.
An update on Monday confirmed that the attack was “loud and very very messy.”
“We could see the agent working automated, because after every action it decided the next step itself, at the speed of light and sloppy logic or pattern. It also looks like the agent skipped a few steps on its learning curve, because it has done some pretty dumb things, like polluting its own MITM attack with password spraying,” the organization said.
“But what makes this attack pretty cool is that the agent is so overexplaining in its comments that it makes our job in reverse engineering a lot easier.”
Yesterday’s update revealed the exploitation of the Zammad zero-days.
DIVD has yet to share which data was accessed by the AI agents and why, but noted that the scope of the compromise has been limited thanks to proper network segmentation and the actions of its IT and incident response team after detection.
“We were able to stop the attackers from going deeper into our systems and network. Unfortunately some of the damage was already done. We’ve found signs of compromise that we’re still looking into, and until we can prove otherwise we assume breach. Still, stopping the attackers is a win and in a situation like this you take every win you can get,” they said.
Whether the DIVD breach was the result of agentic AI attempting to achieve a goal that was part of a larger cyber attack or a cyber capability test is unknown.
Recent findings by AI research laboratory Transluce have revealed that AI agents have also been using hacking tactics (vulnerability probing) while working on ordinary data retrieval tasks.
What Zammad users should do
After determining, with the help of Merlon Security researchers, that the attackers had leveraged two Zammad zero-days, the DIVD CSIRT notified Zammad GmbH, which started working on fixes. Then they started pinpointing internet-exposed vulnerable instances and started notifying the owners.
CVE-2026-102489, which allows attackers to remotely execute malicious code without logging in, affects Zammad versions 6.3.0 to 6.5.4.
CVE-2026-102490, a privilege elevation vulnerability, allows authenticated attackers with low privileges (the local zammad user) to achieve root on the vulnerable system. It affects all versions of Zammad, including the latest alpha release.
Both flaws are currently without a fix, but CVE-2026-102489 is not exploitable in Zammad versions 7.0.0 through 7.1.3 due to environment conditions.
“We advise all users of Zammad to upgrade to version 7 of Zammad or to take it offline. If you want to investigate whether you have been compromised based on our IoCs, you can download our log check script to check your Zammad logfiles for Indicators of Compromise,” the organization noted.
The Dutch NCSC advised making a copy of the application and network logs before installing the update: “If there is more information about the abuse of the second vulnerability, these logs can help you in the future to check if your system has been attacked.”
Subscribe to our breaking news e-mail alert to never miss out on the latest breaches, vulnerabilities and cybersecurity threats. Subscribe here!