Zammad zero-day chain hits DIVD in AI agent-driven attack

The Dutch Institute for Vulnerability Disclosure (DIVD), the Dutch volunteer organisation that responsibly reports vulnerabilities found in exposed systems, has disclosed that it was breached itself. The attackers got in through its Zammad helpdesk using two previously unknown vulnerabilities, CVE-2026-102489 and CVE-2026-102490, and according to DIVD the operation was carried out by artificial intelligence agents.

We have already covered the first vulnerability in a dedicated article. This article covers the incident, the attack chain and the second CVE, based on DIVD’s report and posts as reported by The Register and Infosecurity Magazine.

What happened

• Timeline: according to DIVD’s timeline as reported by The Register, the intrusion took place on 21 September and was discovered the following day. DIVD blocked access to all of its data centre systems and set up a response team with Merlon Security. On 24 September it reported the vulnerabilities to the vendor, notified the Dutch data protection authority and the National Cyber Security Centre, and discussed its options with the police. Infosecurity Magazine instead places the detection of suspicious activity on 24 September: the two outlets differ on the discovery date.
• Stolen data: according to both outlets, the attackers took volunteer data, including DIVD email addresses and possibly other contact details. DIVD is still working out which data of which volunteers is affected.
• Containment: according to Infosecurity Magazine, DIVD wrote that from the Zammad server the attackers reached other services and read and exfiltrated data, but that network segmentation and the team’s response stopped them from going deeper.

The attack chain

Used together, the two vulnerabilities allowed the attackers to hijack sessions, run code remotely and escalate privileges from the zammad user to root: “in seconds”, DIVD wrote, precisely because of the automated part of the attack.

• CVE-2026-102489: according to The Register, it lets an unauthenticated attacker leak user sessions and execute code remotely as the local zammad user. Exploitable versions: 6.3.0 to 6.5.4. The flaw also exists in the 7.x branch but, according to DIVD’s advisory, it is not exploitable due to environment conditions. The Register gives the range as 7.0.0 to 7.1.3, while the NVD description quoted in our previous article stopped at 7.1.2.
• CVE-2026-102490: privilege escalation from a local user to root. According to The Register, all versions of Zammad are vulnerable.
• Score: both have a CVSS 4.0 score of 9.4, assessed in the chained scenario by DIVD, which is also a CNA and assigned both CVEs.
• MITRE ATT&CK, indicative mapping based on the reported facts: T1190 (Exploit Public-Facing Application), T1539 (Steal Web Session Cookie), T1068 (Exploitation for Privilege Escalation).

The sources do not publish indicators of compromise: DIVD said it cannot share more without getting in the way of the investigation.

Why DIVD points to AI agents

DIVD said it had never seen an attack like this, not because of the intrusion itself but because of the modus operandi. According to The Register, it described the attack as “loud and very very messy”: the logs showed an agent that decided its next step on its own after every action, at high speed and with sloppy logic.

The most concrete clue, reported by both outlets, is the comments in the attacker’s scripts: notes in which the agent justifies its own actions, explaining why what it is doing is acceptable and “really not phishing”. A human attacker, DIVD notes, would not bother. This is DIVD’s assessment based on the logs: the sources do not say which model or tool was used, or who is behind it.

Impact for European and Italian organisations

A helpdesk holds tickets, emails and personal data of customers and employees. The DIVD case shows defenders two things: timelines are shrinking, from a stolen session to root in seconds, and segmentation works, since it is what limited the damage. Tim Burke of Quest Technology Management, speaking to Infosecurity Magazine, adds that with attacks at machine speed you need to know in advance who has the authority to isolate systems and block accounts.

There is also an indirect risk: with volunteers’ addresses in the attackers’ hands, it becomes easier to impersonate DIVD. According to The Register, the organisation asks anyone receiving an email or contact request in its name that feels off to verify it by writing to communications@divd.nl.

DIVD notified the incident to the data protection authority and to the national cyber security centre. In Italy the pattern is the same: notification to CSIRT Italia at ACN for NIS2 entities and, where personal data is involved, an assessment of notification to the Garante under the GDPR.

What to do now

1. Inventory: find every Zammad instance and its version; prioritise those reachable from the Internet and versions 6.3.0 to 6.5.4.
2. Update or switch off: DIVD advises all Zammad users to move to version 7 or take the service offline as soon as possible. The sources do not name a version that fixes CVE-2026-102490: check Zammad’s advisory.
3. Reduce exposure and segment: until you have updated, make the helpdesk reachable only from the internal network or over VPN, and restrict connections from the helpdesk server to other internal systems to those actually needed.
4. Look for signs of compromise on instances exposed with vulnerable versions: commands launched by the zammad user, unexpected root processes, new scripts in the application and temporary folders, anomalous sessions, connections from the server to other internal systems. Automated activity shows up in the logs through the speed at which actions follow one another.
5. After updating, terminate active sessions. If you find traces, replace the credentials and tokens used by integrations and consider rebuilding the server: the attacker may have obtained root.

How ARXDOME helps

ARX Expose shows which services your organisation exposes on the Internet and which products are recognised on them, so a helpdesk reachable from outside stands out immediately. ARX Shield lists the open vulnerabilities on monitored machines, highlighting those already exploited, and lets you isolate a suspicious machine from the network. ARX Sentry collects logs and events from servers running the agent, including suspicious executions and file changes in the chosen folders; with ARX Trace, analysts reconstruct what happened through collections and searches across multiple machines.

Last updated: 2 October 2026