AI Agent Exploits Dual Zammad Zero-Days in DIVD Breach

In a notable escalation of automated threat capabilities, the Dutch Institute for Vulnerability Disclosure (DIVD) fell victim to a cyberattack executed by an autonomous agentic AI framework. The attack, detected on September 21, compromised DIVD’s infrastructure by chaining two previously unknown zero-day vulnerabilities in Zammad, an open-source customer support and ticketing system.

While the breach resulted in initial exfiltration and root-level compromise of the ticketing server, network segmentation and swift incident response prevented the autonomous attacker from expanding deeper into critical infrastructure.

Anatomy of the Attack and the Exploited Zammad Zero-Days

The breach relied on a full-chain compromise leveraging two distinct zero-day vulnerabilities in Zammad, identified during post-incident investigation conducted alongside researchers from Merlon Security:

• CVE-2026-102489 (Unauthenticated Remote Code Execution): This vulnerability allows an unauthenticated, remote attacker to execute arbitrary code on the underlying host without valid login credentials. It affects Zammad versions 6.3.0 through 6.5.4. Notably, versions 7.0.0 through 7.1.3 are not susceptible to exploitation due to specific environment conditions, though a formal patch remains pending.
• CVE-2026-102490 (Local Privilege Escalation): Once initial execution is achieved under the context of the low-privileged local zammad user, this vulnerability enables the attacker to elevate privileges directly to root. CVE-2026-102490 impacts all versions of Zammad, including the latest alpha release.

By chaining these two flaws, the attack achieved total host takeover—progressing from unauthenticated internet access to root privileges within seconds.

The Dynamics of Agentic Threat Actors

What sets the DIVD breach apart is the operational profile of the attacker. Rather than relying on static scripts or human operators driving manual commands, the attack was orchestrated by an agentic AI system—an autonomous software agent utilizing large language models to iteratively evaluate environment responses and decide subsequent attack vectors in real time.

DIVD’s Computer Security Incident Response Team (CSIRT) described the agent’s execution as “loud and very, very messy.” Operating at machine speed, the AI agent executed decision-making cycles almost instantaneously. However, its behavioral patterns revealed notable gaps in operational maturity:

• Aggressive, Unrefined Execution: The agent attempted rapid-fire pivots and automated steps, occasionally tripping over its own infrastructure—such as polluting its own man-in-the-middle (MITM) setup by launching simultaneous password spraying attacks against the target.
• Verbose Internal Reasoning: Because the AI agent relied on structured prompting and self-reflection loops, it recorded detailed step-by-step reasoning and contextual commentary in its execution logs. This verbose output provided defenders with an unusually explicit roadmap during post-incident reverse engineering.

This incident highlights both the speed and erratic nature of emerging AI-driven offensive tools, which trade operational stealth for raw execution velocity.

Blast Radius and Vulnerability Disclosure Impact

For an organization like DIVD—whose primary mission involves scanning the internet for vulnerabilities, identifying exposed systems, and coordinating disclosure with vendors, national CERTs, and hosting providers—a central ticketing platform contains highly sensitive telemetry. Support systems often house vulnerability reports, active research notes, draft disclosures, and access credentials.

Network segmentation played a crucial role in preventing a catastrophic breach. Although the AI agent achieved root access on the Zammad server and exfiltrated specific local data, DIVD’s security team halted lateral movement before the agent could compromise broader internal networks or disclosure databases. The incident was reported to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens), the Dutch National Cyber Security Centre (NCSC-NL), and law enforcement.

Mitigation and Actionable Guidance

With official patches from Zammad GmbH still under development for both zero-days, organizations operating Zammad instances must immediately implement defensive measures to mitigate the attack surface.

Recommended Actions for Zammad Administrators

1. Upgrade or Isolate: Immediately upgrade all Zammad installations to version 7.0.0 or higher (up to 7.1.3). While CVE-2026-102490 remains unpatched across all releases, version 7 environments neutralize the initial unauthenticated RCE vector (CVE-2026-102489). Instances that cannot be upgraded to version 7 should be taken offline or restricted behind strict network access controls (e.g., VPN with MFA).
2. Preserve Application and System Logs: Before performing updates or host maintenance, capture full forensic copies of all Zammad application logs, web server access logs, and system audit logs. The Dutch NCSC emphasizes that log retention is vital for retroactive threat hunting as additional details regarding privilege escalation abuse emerge.
3. Execute Indicator of Compromise (IoC) Audits: Run DIVD’s official log check script against stored Zammad log files to scan for indicators of session hijacking, unauthorized command execution, or anomalous privilege escalation attempts associated with these zero-days.