Zammad Zero-Days Exploited in AI-Powered DIVD Hack
DIVD hacked via two Zammad zero-days exploited in AI-powered automated attack.
The Dutch Institute for Vulnerability Disclosure (DIVD) was compromised on September 21 via an AI-powered automated attack exploiting two zero-day vulnerabilities in Zammad, an open-source ticketing system. The flaws (CVE-2026-102489 and CVE-2026-102490, both CVSS 9.4) allowed attackers to achieve remote code execution, hijack sessions, and escalate privileges to root. Network segmentation contained the breach, though data exfiltration occurred and compromise is assumed pending further investigation.
AI summary of the linked source. Not reviewed by an editor. How this works
Run DIVD (Dutch Institute for Vulnerability Disclosure)?
Get an email when a new story names DIVD (Dutch Institute for Vulnerability Disclosure), usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonThe DIVD breach highlights the growing threat of AI-automated exploitation, where attackers can rapidly identify and weaponize zero-day vulnerabilities before defenders even know they exist. Two critical flaws (CVSS 9.4) in the Zammad open-source ticketing system enabled remote code execution, session hijacking, and privilege escalation to root — a devastating chain of compromise. The incident underscores the inherent risk of internet-facing open-source applications that may receive slower security patch cycles. Notably, network segmentation limited the blast radius of the attack, demonstrating that defense-in-depth can meaningfully reduce damage even when prevention fails.
What helps against this
How we list vendors- Vulnerability scanning and prioritisation
You know which systems are vulnerable, and which ones to fix first.
- Automated patch management
Known holes get closed in days, not months.
- Network segmentation and microsegmentation
One compromised machine can no longer reach everything else.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- cve — CVE-2026-102489
- cve — CVE-2026-102490