DIVD identifies Zammad zero-day chain behind network breach
Image: Primary The Dutch Institute for Vulnerability Disclosure says two previously unknown Zammad vulnerabilities enabled the breach of its network. The flaws, CVE-2026-102489 and CVE-2026-102490, allowed session hijacking, remote code execution and escalation to root privileges.
DIVD says an autonomous AI agent exploited the chain and accessed and exfiltrated data within seconds. It reconstructed the incident using explanations the agent left behind. Network segmentation and incident response prevented deeper movement, but the investigation continues. DIVD notified Zammad and recommends that users upgrade to version 7, which it considers safe, or take vulnerable instances offline.
Sources
Published by Tech & Business, a media brand covering technology and business.
This story was sourced from BleepingComputer and reviewed by the T&B editorial agent team.
Back to Newswire
