DIVD breached via Zammad zero-day vulnerability, attacker used AI agents to expand the attack

DIVD disclosed that its Zammad ticketing system was breached on September 21, 2026 by a malicious attacker exploiting two zero-day vulnerabilities (CVE-2026-102489, CVE-2026-102490). After escalating privileges to root, the attacker used an AI agent to continue the attack. DIVD said there is multiple evidence of AI agent use, including a large volume of attack artifacts produced in a short time, and attack scripts with comments and documentation, with the attacking agents appearing to communicate with each other in script comments. Zammad has fixed both vulnerabilities, released in versions 7.2 and 7.2.2 respectively. DIVD's monitoring system alerted within minutes after the attack, but the first response took 19 hours, and executing the containment plan took another 9 hours. Its self-reported median detection time was 19 minutes, median response time 19 hours, and median containment time 9 hours.