BreachPublished 30 Sep 2026

DIVD says Zammad zero-days enabled AI-driven network breach

Source Bleeping Computer

Mentions 2 CVEs

Mentioned vulnerabilities

zero-day

Description

The Dutch Institute for Vulnerability Disclosure (DIVD) suffered a network breach through exploitation of two zero-day vulnerabilities in the open-source Zammad ticketing system. The attack was driven by an autonomous AI agent that chained the vulnerabilities to hijack sessions, execute remote code, and escalate privileges to root within seconds. Due to network segmentation and incident response, the attacker did not penetrate deeper into DIVD's network. DIVD recommends upgrading to Zammad version 7 or taking vulnerable instances offline. The investigation is ongoing.

Impact

The exploitation of the two zero-day vulnerabilities allowed attackers to gain full control over the Zammad application environment, including session hijacking, remote code execution, and root privilege escalation. This enabled access to other services and data exfiltration from DIVD's systems. The attack was rapid and automated by an AI agent, increasing the speed and complexity of the breach. However, network segmentation and incident response prevented deeper network compromise.

Defensive guidance

DIVD recommends that all Zammad users upgrade to version 7, which addresses these vulnerabilities and is considered safe. Alternatively, users should take vulnerable Zammad instances offline immediately. No other mitigation guidance is provided, and the vendor advisory status should be monitored for updates. Patch status is confirmed by the recommendation to upgrade to version 7.

References

bleepingcomputer.com/news/security/divd-says-zammad-zero-days-enabled-ai-driven-network-breach/ (opens in a new tab)

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 30 Sep 2026, 20:03 UTC

References

Community reviews

Related threats