[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fb0rgebhKrkZOOYE78bs6KB1LG89Ewm_z6ak_-R09MVY":3},{"article":4,"iocs":47,"watch_terms":55,"solutions":56,"lesson":142},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":26,"category":27,"article_tags":31},"3e6e3d96-2311-41a7-92b2-04b09d2d9642","Zammad Zero-Days Exploited in AI-Powered DIVD Hack","zammad-zero-days-exploited-in-ai-powered-divd-hack-c06bed","The flaws were chained to hijack sessions, achieve remote code execution, and elevate privileges to root. The post Zammad Zero-Days Exploited in AI-Powered DIVD Hack appeared first on SecurityWeek.","The Dutch Institute for Vulnerability Disclosure (DIVD) was compromised on September 21 via an AI-powered automated attack exploiting two zero-day vulnerabilities in Zammad, an open-source ticketing system. The flaws (CVE-2026-102489 and CVE-2026-102490, both CVSS 9.4) allowed attackers to achieve remote code execution, hijack sessions, and escalate privileges to root. Network segmentation contained the breach, though data exfiltration occurred and compromise is assumed pending further investigation.","DIVD hacked via two Zammad zero-days exploited in AI-powered automated attack.","https:\u002F\u002Fwww.securityweek.com\u002Fzammad-zero-days-exploited-in-ai-powered-divd-hack\u002F","https:\u002F\u002Fwww.securityweek.com\u002Fwp-content\u002Fuploads\u002F2023\u002F06\u002Fzero-day-e1772721069481.jpg","2026-10-01T10:42:49+00:00","2026-10-01T12:00:19.249389+00:00",9,[17,20,23],{"name":18,"type":19},"DIVD (Dutch Institute for Vulnerability Disclosure)","vendor",{"name":21,"type":22},"Zammad","product",{"name":24,"type":25},"AI-powered agentic attack automation","technology","574f766a-fb3f-487c-8d2c-0720ae75471b",{"id":26,"icon":28,"name":29,"slug":30},null,"Zero-day","zero-day",[32,37,42],{"category":33},{"id":34,"icon":28,"name":35,"slug":36},"80544778-fabb-4dcd-aa35-17492e5dcf4f","Vulnerabilities","vulnerabilities",{"category":38},{"id":39,"icon":28,"name":40,"slug":41},"839da5c1-3c34-47e2-9499-f7201640e3ac","AI Security","ai-security",{"category":43},{"id":44,"icon":28,"name":45,"slug":46},"ade75414-7914-4e23-a450-48b64546ee70","Open Source","open-source",[48,52],{"type":49,"value":50,"context":51},"cve","CVE-2026-102489","Zammad zero-day enabling unauthenticated RCE and session leak (CVSS 9.4)",{"type":49,"value":53,"context":54},"CVE-2026-102490","Zammad zero-day allowing local privilege escalation to root (CVSS 9.4)",[18,21],{"controls":57,"vendors":141},[58,87,112],{"slug":59,"name":60,"problem":61,"products":62},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[63,71,79],{"vendor_slug":64,"vendor_name":65,"vendor_logo":66,"product_slug":67,"product_name":68,"url":69,"description":70},"holm-security","Holm Security","\u002Fvendor-logos\u002Fholm-security.png","holm-security-platform","Holm Security Platform","https:\u002F\u002Fwww.holmsecurity.com\u002F","Vulnerability scanning of systems, web applications, cloud and the external attack surface, plus phishing simulation.",{"vendor_slug":72,"vendor_name":73,"vendor_logo":74,"product_slug":75,"product_name":76,"url":77,"description":78},"rapid7","Rapid7","\u002Fvendor-logos\u002Frapid7.png","insightvm","Rapid7 Exposure Command (InsightVM)","https:\u002F\u002Fwww.rapid7.com\u002Fproducts\u002Finsightvm\u002F","Vulnerability scanning and risk-based prioritisation; InsightVM is now part of Exposure Command, alongside attack surface and cloud risk.",{"vendor_slug":80,"vendor_name":81,"vendor_logo":82,"product_slug":83,"product_name":84,"url":85,"description":86},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","vmdr","Qualys VMDR","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fvulnerability-management-detection-response\u002F","Vulnerability management, detection and response with risk-based prioritisation.",{"slug":88,"name":89,"problem":90,"products":91},"patch-management","Automated patch management","Known holes get closed in days, not months.",[92,100,104],{"vendor_slug":93,"vendor_name":94,"vendor_logo":95,"product_slug":96,"product_name":97,"url":98,"description":99},"ivanti","Ivanti","\u002Fvendor-logos\u002Fivanti.png","neurons-patch-management","Ivanti Neurons for Patch Management","https:\u002F\u002Fwww.ivanti.com\u002Fproducts\u002Fivanti-neurons-for-patch-management","Risk-based patch management for operating systems and third-party applications.",{"vendor_slug":80,"vendor_name":81,"vendor_logo":82,"product_slug":88,"product_name":101,"url":102,"description":103},"Qualys Patch Management","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fpatch-management\u002F","Patch deployment for operating systems and third-party applications, linked to vulnerability findings.",{"vendor_slug":105,"vendor_name":106,"vendor_logo":107,"product_slug":108,"product_name":109,"url":110,"description":111},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",{"slug":113,"name":114,"problem":115,"products":116},"network-segmentation","Network segmentation and microsegmentation","One compromised machine can no longer reach everything else.",[117,125,133],{"vendor_slug":118,"vendor_name":119,"vendor_logo":120,"product_slug":121,"product_name":122,"url":123,"description":124},"akamai","Akamai","\u002Fvendor-logos\u002Fakamai.png","guardicore-segmentation","Akamai Guardicore Segmentation","https:\u002F\u002Fwww.akamai.com\u002Fproducts\u002Fakamai-guardicore-segmentation","Software-based microsegmentation with traffic visibility.",{"vendor_slug":126,"vendor_name":127,"vendor_logo":128,"product_slug":129,"product_name":130,"url":131,"description":132},"threatlocker","ThreatLocker","\u002Fvendor-logos\u002Fthreatlocker.png","zero-trust-endpoint-firewall","Zero Trust Endpoint Firewall","https:\u002F\u002Fwww.threatlocker.com\u002Fcapabilities\u002Fzero-trust-endpoint-firewall","Centrally managed host firewall with device-level and dynamic access rules, to limit which machines can talk to each other.",{"vendor_slug":134,"vendor_name":135,"vendor_logo":136,"product_slug":137,"product_name":138,"url":139,"description":140},"illumio","Illumio","\u002Fvendor-logos\u002Fillumio.png","illumio-segmentation","Illumio Segmentation","https:\u002F\u002Fwww.illumio.com\u002Fillumio-segmentation","Maps traffic between workloads and enforces segmentation across data centre, cloud and endpoints.",[],{"slug":143,"title":144,"body":145,"framework_refs":146,"framework_notes":160},"zero-day-exploits-in-zammad-ticketing-system-breach-divd-via-ai-powered-attack","Zero-Day Exploits in Zammad Ticketing System Breach DIVD via AI-Powered Attack","The DIVD breach highlights the growing threat of AI-automated exploitation, where attackers can rapidly identify and weaponize zero-day vulnerabilities before defenders even know they exist. Two critical flaws (CVSS 9.4) in the Zammad open-source ticketing system enabled remote code execution, session hijacking, and privilege escalation to root — a devastating chain of compromise. The incident underscores the inherent risk of internet-facing open-source applications that may receive slower security patch cycles. Notably, network segmentation limited the blast radius of the attack, demonstrating that defense-in-depth can meaningfully reduce damage even when prevention fails.",[147,148,149,150,151,152,153,154,155,156,157,158,159],"CIS Control 7: Continuous Vulnerability Management","CIS Control 12: Network Infrastructure Management","CIS Control 13: Network Monitoring and Defense","CIS Control 18: Penetration Testing","NIST SP 800-53 SI-2: Flaw Remediation","NIST SP 800-53 AC-6: Least Privilege","NIST SP 800-53 SC-7: Boundary Protection","NIST SP 800-53 AU-12: Audit Record Generation","NIST CSF ID.RA-1: Asset Vulnerabilities Identified","NIST CSF PR.PT-4: Communications and Control Networks Protected","GDPR Article 32: Security of Processing","GDPR Article 33: Notification of a Personal Data Breach","ITIL: Change and Release Management (Emergency Change Procedure)",{}]