DIVD says Zammad zero-days enabled AI-driven network breach

The Dutch vulnerability disclosure nonprofit DIVD has revealed that attackers compromised its own network by chaining two previously unknown flaws in the open-source Zammad helpdesk software, tracked as CVE-2026-102489 and CVE-2026-102490. Together these bugs allowed session takeover, remote code execution, and privilege escalation from a regular Zammad account to full root access, all carried out within seconds by an autonomous AI agent rather than a human operator. Because the agent logged its own reasoning during the intrusion, DIVD was able to reconstruct exactly how the breach unfolded, though network segmentation and quick response reportedly stopped the attacker from reaching deeper into the organization's systems. DIVD, working with Merlon Security, has notified Zammad and is urging the platform's roughly 2,000 customers and 55,000 users to upgrade to Zammad version 7 or take vulnerable instances offline immediately.