An Autonomous AI Agent Chains Two Zammad Zero-Days to Breach the Dutch Institute for Vulnerability Disclosure (CVE-2026-102489, CVE-2026-102490)

The Dutch Institute for Vulnerability Disclosure (DIVD), a volunteer nonprofit and CVE Numbering Authority, through its self-hosted Zammad helpdesk

DIVD was breached on September 21, 2026 and detected the intrusion the next day. The attacker chained two previously unknown Zammad flaws, an unauthenticated remote code execution and session leak (CVE-2026-102489) and a privilege escalation to root (CVE-2026-102490), going from session hijack to root "in seconds," then moved on to other services, ran password spraying and a man-in-the-middle attack, and exfiltrated volunteer researchers' email addresses and possibly other contact details. DIVD said "the modus operandi indicates that this is an agentic AI powered attack": the intrusion was "loud and very very messy," the agent "decided the next step itself, at the speed of light and sloppy logic," left comments in its scripts justifying its actions, and polluted its own man-in-the-middle attack with password spraying. Network segmentation limited the damage. It is DIVD's first breach in seven years. No Zammad patch existed at disclosure; DIVD advised upgrading to Zammad 7.0.0 or later, where the RCE is present but not exploitable, or taking instances offline. The operator and model are unknown

Unpatched zero-days in an internet-facing helpdesk holding sensitive casework, exploited by an agent that turned a foothold into root and lateral movement without a human pacing it