Zammad Zero-Days Exploited in AI-Powered DIVD Hack

The Dutch Institute for Vulnerability Disclosure (DIVD) says it suffered a breach on September 21 after attackers used an agentic AI system to exploit two previously unknown flaws in the open-source helpdesk platform Zammad. DIVD describes the intrusion as unlike anything it has handled before, noting the automated nature of the attack chain. The first bug, CVE-2026-102489 (CVSS 9.4), lets unauthenticated attackers hijack sessions and execute code remotely, while the second, CVE-2026-102490 (CVSS 9.4), allows a local account to escalate privileges to root; chained together, these flaws let the intruders move from ordinary Zammad access to full root control within seconds. The attackers reportedly pivoted toward other connected services and pulled out some data, though network segmentation limited further damage, and DIVD says it is still treating the incident as a confirmed breach while investigating remaining signs of compromise. Zammad versions 6.3.0 through 6.5.4 are vulnerable, and while 7.0.0 through 7.1.3 technically contain the same bug, real-world conditions block exploitation there; DIVD urges all Zammad users to update to version 7 or take affected instances offline, and has released a detection script plus is actively scanning the internet to warn exposed organizations.