The Dutch Institute for Vulnerability Disclosure (DIVD), a nonprofit cybersecurity research organization, has confirmed it was compromised through two zero-day vulnerabilities in its Zammad support platform. The attack, which occurred on September 21, involved session hijacking, remote code execution, and privilege escalation to root access, leading to the theft of email addresses and potentially other contact details belonging to DIVD's volunteer security researchers.
The two vulnerabilities, now assigned CVE-2026-102489 and CVE-2026-102490, were exploited in a chained attack that took "seconds" to achieve root access. CVE-2026-102489 allows unauthenticated attackers to achieve remote code execution and leak user sessions. It affects Zammad versions 6.3.0 to 6.5.4, and while present in versions 7.0.0 through 7.1.3, it is not exploitable in those due to environmental conditions. CVE-2026-102490 permits a local user to escalate privileges to root and affects all versions of Zammad. Both CVEs received CVSS 4.0 scores of 9.4 when assessed in the chained attack scenario.
DIVD, which also functions as a CVE Numbering Authority (CNA), has advised all Zammad users to upgrade to version 7 or take their systems offline. The organization reported the vulnerabilities to the Zammad vendor on September 24.
According to DIVD's incident report, the stolen data increases the risk of social engineering for its volunteers. The organization has advised anyone receiving suspicious contact requests from someone claiming to be from DIVD to verify legitimacy by emailing communications@divd.nl.
DIVD discovered the breach on September 22, promptly blocking access to its data center systems and forming an incident response team with Merlon Security. The incident was reported to the Dutch Data Protection Authority and the National Cyber Security Centre, and discussions were held with law enforcement.
The organization described the attack as "loud and very very messy," noting that the "modus operandi indicates that this is an agentic AI powered attack." DIVD observed the attacker's actions as automated, with decisions made at high speed and exhibiting "sloppy logic or pattern." Further investigation revealed embedded notes within the attack script, which DIVD interpreted as the AI justifying its actions, a characteristic not typically seen in human-driven attacks.
DIVD has been praised by security researchers for its transparency in disclosing the incident. The organization stated its commitment to handling the breach openly, transparently, and honestly, even in challenging circumstances.
