DIVD reported a network breach enabled by exploiting two zero-day vulnerabilities (CVE-2026-102489 and CVE-2026-102490) in the Zammad open-source ticketing platform. These flaws allowed attackers to hijack user sessions, perform remote code execution, and escalate privileges from a Zammad user to root rapidly. The attack was automated by an AI agent that autonomously decided its actions, enabling swift lateral movement and data exfiltration within seconds. DIVD discovered the vulnerabilities in collaboration with Merlon Security and notified Zammad. The organization advises users to upgrade to version 7, which is considered secure, or to take affected instances offline. The breach was contained due to network segmentation and incident response measures, and further investigation is ongoing.

The exploitation of the two zero-day vulnerabilities allowed attackers to gain full control over the Zammad application environment, including session hijacking, remote code execution, and root privilege escalation. This enabled access to other services and data exfiltration from DIVD's systems. The attack was rapid and automated by an AI agent, increasing the speed and complexity of the breach. However, network segmentation and incident response prevented deeper network compromise.

DIVD recommends that all Zammad users upgrade to version 7, which addresses these vulnerabilities and is considered safe. Alternatively, users should take vulnerable Zammad instances offline immediately. No other mitigation guidance is provided, and the vendor advisory status should be monitored for updates. Patch status is confirmed by the recommendation to upgrade to version 7.