Skip to content
The Injection_
LIVE
LIVElast sweep next in--:--:--

[ RSS ][ JSON ][ llms.txt ]

CRITIncidentVulnerability

CISA: Zammad flaws exploited after agentic AI breached DIVD

Two Zammad zero-days found during a breach of DIVD are now on the US catalog of flaws being exploited in the wild.

· CISA · Research by Victor Pasman (DIVD), Mischa Rick van Geelen (DIVD), Ralph Horn (DIVD), Max van der Horst (DIVD), Frank Breedijk (DIVD), Davy Aarts (DIVD), Earth Grob (Merlon Security), Luke Paris (Merlon Security), Tijmen van der Spijk (Merlon Security), Zohar Cochavi (Merlon Security), Alje Woltjer (Merlon Security)

CVE-2026-102489
CRITIncident

CISA added two Zammad helpdesk flaws, CVE-2026-102489 and CVE-2026-102490, to its Known Exploited Vulnerabilities catalog on October 2, 2026, after DIVD said an agentic AI attack chained them to breach its network.

01What happened

CISA added CVE-2026-102489 and CVE-2026-102490 to its Known Exploited Vulnerabilities catalog on October 2, 2026, citing evidence of active exploitation. The two Zammad flaws were found by DIVD and Merlon Security researchers while investigating a breach of DIVD itself on September 21, 2026, which DIVD says bears the marks of an agentic AI attack. Zammad published its own advisory on October 5, 2026.

02How it works

CVE-2026-102489 is a session fixation flaw in the Zammad helpdesk: an attacker with no valid credentials can hijack a session and reach code execution as the zammad service account. CVE-2026-102490 then lifts that low-privileged zammad user to root. Chained, the pair turn an unauthenticated web request into full control of the host, which is how DIVD says the intruder reached other services and data on its network.

03Who is affected

DIVD lists Zammad 6.3.0 through 6.5.4 as exploitable for the session flaw, and says the same code in 7.0.0 through 7.1.3 is not exploitable because of the runtime those versions use. Zammad agrees that 7.0 and later are not affected in practice. The privilege escalation covers a far wider range, which DIVD summarizes as all versions including the latest alpha.

04What to do

Upgrade to Zammad 7, or take the instance offline, as DIVD advises. Run DIVD's log check script from the DIVD-2026-00015 case page to look for indicators of compromise, and restrict shell access on the Zammad host to trusted administrators, per Zammad's advisory.

Questions people ask

Which Zammad versions are affected by CVE-2026-102489?
Zammad 6.3.0 through 6.5.4 are exploitable, according to DIVD's case file, which also says the same code is present in 7.0.0 through 7.1.3 but cannot be exploited there because of the runtime those versions use. Zammad agrees that 7.0 and later are not affected in practice, and notes 6.5 and earlier no longer receive security updates.
Is there a fix for CVE-2026-102490 in Zammad?
No full fix for CVE-2026-102490 had been released when Zammad published its advisory on October 5, 2026. Zammad describes the flaw as local privilege escalation that cannot be exploited remotely on its own, says it is related to a confirmed packager.io vulnerability, and states that its team is working on a solution. DIVD lists the flaw as affecting all versions.
How do I check whether my Zammad server was compromised?
DIVD published an indicator-of-compromise log check script for CVE-2026-102489, available from its DIVD-2026-00015 case page. DIVD advises running it against your Zammad logs, then upgrading to Zammad 7 or taking the instance offline. Zammad separately recommends restricting access to the underlying server to trusted administrators only, because the privilege escalation flaw needs server access first.
What evidence says an AI agent carried out the DIVD breach?
DIVD states that the modus operandi indicates an agentic AI powered attack, and says its investigation is ongoing and it cannot rule anything out. DIVD has not published the technical evidence behind that assessment. The attribution is DIVD's own reading of how the attack behaved, not a vendor or government finding, so treat the agentic element as a claim under investigation.

Sources 4 links, all fetched

  1. 1cisa.govCISA KEV Alert
  2. 2csirt.divd.nlDIVD Case File
  3. 3zammad.comZammad Advisory
  4. 4csirt.divd.nlDIVD Breach Post

Related