The Dutch Institute for Vulnerability Disclosure was targeted in an automated AI-driven attack exploiting two zero-day vulnerabilities in Zammad. The first vulnerability (CVE-2026-102489, CVSS 9.4) enables unauthenticated remote code execution and session leakage. The second (CVE-2026-102490, CVSS 9.4) allows local privilege escalation to root. Combined, these flaws enabled attackers to hijack sessions, execute code remotely, and escalate privileges rapidly. The attackers pivoted from the compromised Zammad instance to other services and exfiltrated data, though network segmentation prevented deeper access. Affected versions are Zammad 6.3.0 through 6.5.4 and 7.0.0 through 7.1.3 (with exploitation in the latter limited by environment). DIVD has notified Zammad, which is developing a fix, and advises upgrading to version 7 or taking the system offline. DIVD also provides a verification script for detection and is scanning for vulnerable instances.

The vulnerabilities allow unauthenticated attackers to remotely execute code and leak user sessions, and local users to escalate privileges to root. This enables full system compromise of affected Zammad instances, including session hijacking and root-level access. The attack against DIVD resulted in data exfiltration from the Zammad instance and potential compromise of other services. Network segmentation limited the attacker's lateral movement beyond the initial environment. Until remediation is applied, affected systems remain at high risk of compromise.

Zammad is working on a fix for the reported zero-day vulnerabilities. Users are advised to upgrade to Zammad version 7 or later, or take the system offline until a patch is available. DIVD has published a verification script to detect indicators of compromise and is actively scanning for vulnerable instances. Organizations should apply the verification script to assess exposure and monitor for signs of compromise. Patch status is pending; check the official Zammad advisories for updates on fixes.