Autonomous AI agent exploits Zammad zero-day vulnerability to breach DIVD

DIVD disclosed that its Zammad ticketing system was breached on September 21, 2026 by a malicious attacker exploiting two zero-day vulnerabilities (CVE-2026-102489, CVE-2026-102490). After escalating privileges to root, the attacker used an AI agent to continue the attack. DIVD said there is multiple evidence of AI agent use, including a large volume of attack artifacts produced in a short time, and attack scripts with comments and documentation, with the attacking agents appearing to communicate with each other in script comments. Zammad has fixed both vulnerabilities, released in versions 7.2 and 7.2.2 respectively. DIVD's monitoring system alerted within minutes after the attack, but the first response took 19 hours, and executing the containment plan took another 9 hours. Its self-reported median detection time was 19 minutes, median response time 19 hours, and median containment time 9 hours.

CSA research brief synthesizing DIVD's announcement and media reports: the network of the Dutch Institute for Vulnerability Disclosure (DIVD) was breached on September 21, 2026. Based on the modus operandi, DIVD judged the attacker to be an autonomous AI agent not directed by a human. This attribution comes from the victim and has not been independently confirmed. The attack chained two previously unknown vulnerabilities in Zammad: CVE-2026-102489 session hijacking allowed the attacker to execute code as the low-privilege zammad user (versions 6.3.0 through 6.5.4 affected; 7.0.0 through 7.1.3 affected but not exploitable due to environmental differences), and CVE-2026-102490 allowed local privilege escalation to root (all versions tested by DIVD affected, including the current 7.1.0 alpha). From session hijacking to root took only seconds. DIVD described the attack as "noisy and chaotic": the agent's password spraying interfered with its own man-in-the-middle setup, and the large amount of self-narration left in code comments actually helped forensics. Network segmentation blocked further lateral movement, but unauthorized access was confirmed, and the scope of data exposure is still under investigation. Upgrading to version 7 only closed this entry point; the privilege escalation vulnerability remains unfixed.

Sysdig's review states that on September 21, 2026, an agentic threat actor (ATA) exploited two zero-day vulnerabilities in the Zammad customer support platform, CVE-2026-102489 and CVE-2026-102490, to breach the Dutch Institute for Vulnerability Disclosure (DIVD), going from session hijacking to root privileges in only seconds. CVE-2026-102489 is a remote code execution vulnerability affecting versions 6.3.0 through 6.5.4, with a CVSS score of 8.7; CVE-2026-102490 is a local privilege escalation vulnerability affecting versions 1.5.0 through 7.1.0-alpha, with a CVSS score of 8.5; chained together, the CVSS score is 9.4. DIVD discovered the breach on September 22 and cut off all system access in its data center. On October 1, it confirmed data exfiltration, confirming that volunteer email addresses were leaked, with contact information possibly leaked as well.