The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added two vulnerabilities in Zammad GmbH's Zammad helpdesk software to its Known Exploited Vulnerabilities (KEV) catalog, mandating that federal agencies address them by October 5, 2026. These flaws, identified as CVE-2026-102489 and CVE-2026-102490, have been actively exploited in the wild, including in a recent breach of the Dutch Institute for Vulnerability Disclosure (DIVD).
CVE-2026-102489, with a CVSS score of 9.4, is a session fixation vulnerability that can lead to remote code execution as the `zammad` user. This flaw affects Zammad versions 6.3.0 through 6.5.4, and also versions 7.0.0 through 7.1.3. The second vulnerability, CVE-2026-102490, also rated with a CVSS score of 9.4, is an improper privilege management vulnerability. It allows the `zammad` user to escalate privileges to root and impacts Zammad versions from 1.5.0 through 7.1.0-alpha.
The DIVD, a nonprofit organization of volunteer security researchers, confirmed it was breached through the exploitation of these two zero-day vulnerabilities in its internal Zammad ticketing system. The attackers chained CVE-2026-102489 to gain initial code execution as the `zammad` user, then used CVE-2026-102490 to escalate to root privileges. DIVD, working with Merlon Security, identified these previously unknown flaws during its incident response.
The speed of the attack was notable, with the attackers moving from initial access to root privileges within seconds. DIVD attributed this rapid progression to the use of an AI agent, which was capable of making decisions and executing subsequent steps without direct human intervention. This agent was able to analyze the environment, chain the vulnerabilities, and escalate privileges to access other services, read, and exfiltrate data.
Following the root access gained through Zammad, the attackers accessed other services and stole some data. However, network segmentation and a swift response from DIVD’s IT and incident response teams prevented further lateral movement. DIVD stated that some damage had occurred before the attack was halted, and the investigation remains ongoing.
Zammad, which serves over 2,000 customers and 55,000 users, has advised all users to update to version 7 or take their systems offline immediately if an update is not possible. Version 7 is considered safe by Zammad. DIVD is actively notifying owners of vulnerable instances and has provided a script to help organizations check their logs for signs of abuse.
The incident highlights the growing threat of AI-driven attacks, demonstrating that such capabilities are no longer merely theoretical. While the AI agent in this attack left visible traces, aiding investigators, a more sophisticated or discreet agent could pose a greater detection challenge. CISA's inclusion of these vulnerabilities in its KEV catalog underscores the critical need for all organizations, including private entities, to review and address these flaws in their infrastructure to protect against similar exploits.
