AI agent exploits Zammad zero-days in DIVD breach: What we know and how to detect it

DIVD reported that an apparent autonomous AI agent breached its systems on September 21, 2026 by chaining two previously undisclosed Zammad helpdesk vulnerabilities: CVE-2026-102489, a remote code execution flaw affecting versions 6.3.0 through 6.5.4, and CVE-2026-102490, a local privilege-escalation flaw affecting a broad range of versions. The attacker reportedly progressed from session hijacking to root access within seconds, then conducted credential attacks, accessed data, and exfiltrated volunteer email addresses, while other potentially affected systems and data remained under investigation. DIVD detected the intrusion the following day, isolated its data-center systems, investigated with external support, disclosed the incident to authorities and Zammad, and began notifying exposed Zammad users. The operation was characterized as unusually noisy and self-documenting, with scripts containing explanatory comments and password spraying that interfered with its own activity, helping investigators identify it despite its speed. The account emphasizes that defenders should upgrade or take vulnerable Zammad instances offline, isolate helpdesk systems through network segmentation, preserve logs and investigate indicators of compromise, rotate accessible credentials, and focus runtime monitoring on behavioral signals such as service accounts spawning shells, privilege escalation to root, credential-file access, and unfamiliar outbound network connections rather than relying solely on known vulnerability signatures.

Use this post, company, and trend context to find content marketing opportunities, perform competitive analysis, or address product feature gaps via the Plushcap MCP server or the Plushcap API.