3 OCT 2026 — The Dutch Institute for Vulnerability Disclosure (DIVD) is a volunteer group that finds security holes in other people's software and warns the organisations affected. On 21 September it was breached through two unknown flaws in Zammad, the open-source helpdesk system it used. DIVD says an AI agent ran the attack, and one of the two flaws still has no fix.
In the past week DIVD has published a running account of the incident, released case files for both flaws, and started scanning the internet to warn other Zammad users.
How the break-in worked
The first flaw, CVE-2026-102489, lets an attacker hijack a user's session and run code on the server as the Zammad user. According to DIVD's case file, it affects Zammad versions 6.3.0 to 6.5.4. The same flaw exists in 7.0.0 to 7.1.3 but cannot be exploited there because of how those versions are set up.
The second, CVE-2026-102490, lets the local Zammad user make itself root, the administrator of the whole machine. DIVD says it affects every version of Zammad from 1.5.0, "including the latest alpha". Together, the two flaws took the attacker from outside to full control of the server "in seconds due to the agentic part of this hack," DIVD wrote.
Why DIVD blames an AI agent
On 26 September DIVD published redacted log screenshots showing that the attacker's scripts contained notes in which the agent justified its own actions, explaining why what it was doing was acceptable and "really not phishing." DIVD said a human attacker would not bother writing such notes.
Its 29 September statement described the attack as "loud and very messy," with the agent "deciding each next step itself at speed on sloppy logic." The over-explaining comments made the attack easier to reverse-engineer, DIVD said. It has found no link to any known threat actor, and nothing so far suggests anyone targeted DIVD to reach its most sensitive data, though it cannot rule that out.
What was taken
On 1 October DIVD said volunteer data had left its network, including DIVD email addresses and possibly contact details. Exactly whose data and which fields are still being established. Network segmentation and its incident response stopped the attackers going deeper, DIVD says, but "some of the damage was already done." It warned that the leak makes it easier for someone to pose as a DIVD volunteer, and asked anyone who receives an odd message from the group to check with it first.
DIVD reported the incident to the Dutch data protection authority and the national cyber security centre, NCSC-NL, and discussed the case with police, according to its incident page.
What Zammad users should do
DIVD advises Zammad users to upgrade to version 7 or take their systems offline, and has published a script that checks Zammad logs for signs of this attack. Version 7 closes off the remote entry point in practice. The root-escalation flaw remains, and DIVD says Zammad is working on a fix.
DIVD reported the flaws to Zammad on 24 September and began notifying owners of exposed systems on 26 September. Zammad says on its website that it has more than 2,000 customers, BleepingComputer reports.
The pattern
The Zammad flaws were exploited before Zammad knew they existed, the same pattern seen this autumn in several internet-facing products, including Fortinet's FortiMail gateway this week. The difference is the victim. DIVD warns others about exactly this kind of hole, and it has turned its own breach into a case file and a scanning campaign.
View author profile → · Editorial policy
