DIVD Breached via AI-Driven Zero-Day Exploits in Zammad

• •DIVD was breached through two zero-day vulnerabilities in Zammad.
• •An AI agent automated the exploitation, achieving root access in seconds.
• •CVE-2026-102489 and CVE-2026-102490 were confirmed as critical vulnerabilities.

The Dutch Institute for Vulnerability Disclosure (DIVD) confirmed a breach involving two zero-day vulnerabilities (CVE-2026-102489 and CVE-2026-102490) in its Zammad helpdesk system. An attacker utilized an AI agent to automate the exploitation process, achieving root access in seconds. The vulnerabilities allowed for session hijacking, remote code execution, and privilege escalation. DIVD's rapid response and network segmentation mitigated further damage, but data exfiltration occurred before containment. The attack was notable for its speed and automation, raising concerns about future undetected exploits. The vulnerabilities were added to the CISA KEV list on October 2, 2026.