AI agent chains two Zammad zero-day vulnerabilities to breach DIVD and steal data
AI agent exploits Zammad zero-days in DIVD breach: What we know and how to detect it
Sysdig's review states that on September 21, 2026, an agentic threat actor (ATA) exploited two zero-day vulnerabilities in the Zammad customer support platform, CVE-2026-102489 and CVE-2026-102490, to breach the Dutch Institute for Vulnerability Disclosure (DIVD), going from session hijacking to root privileges in only seconds. CVE-2026-102489 is a remote code execution vulnerability affecting versions 6.3.0 through 6.5.4, with a CVSS score of 8.7; CVE-2026-102490 is a local privilege escalation vulnerability affecting versions 1.5.0 through 7.1.0-alpha, with a CVSS score of 8.5; chained together, the CVSS score is 9.4. DIVD discovered the breach on September 22 and cut off all system access in its data center. On October 1, it confirmed data exfiltration, confirming that volunteer email addresses were leaked, with contact information possibly leaked as well.