Two previously unknown vulnerabilities in the Zammad support system were exploited in the network breach at the Dutch Vulnerability Disclosure Institute (DIVD). Researchers have documented them as CVE-2026-102489 and CVE-2026-102490 , and report that the combination allowed session hijacking, code execution, and administrative privileges, while data was read and extracted from the organization's infrastructure.
The network breach occurred on September 21, according to the DIVD timeline, when attackers exploited the vulnerability during an attack against the same group that investigates and discloses digital vulnerabilities. On September 30, the DIVD published the technical details and CVE numbers as it continues its investigation and notifies administrators of exposed installations.
See also: First AI agent data breach reported to Spanish regulator
How the network breach evolved
CVE -2026-102489 concerns a vulnerability that could allow session hijacking and command execution as the Zammad user. DIVD says that versions 6.3.0 to 6.5.4 are affected. The same vulnerability exists in versions 7.0.0 to 7.1.3, but, according to the listing, it is not exploitable under the specific system conditions.
The second vulnerability, CVE-2026-102490, allowed Zammad's local account to gain administrator privileges on the operating system. The CVE entry describes affected versions from 1.5.0 to pre-release 7.1.0-alpha. This vulnerability becomes particularly serious when combined with the first, because it turns application access into broader control of the server.
In the DIVD attack, the sequence of the two vulnerabilities reportedly allowed a transition from session hijacking to remote code execution and then privilege escalation. The rating of CVE-2026-102489 reaches 9.4 when the chain with the second gap is taken into account, according to data published on the CVE registry.
What DIVD knows about the breach
The network breach gave the perpetrators access to other services, from where they read and extracted data, according to the DIVD incident response service. The organization says the activity took place within seconds. However, the investigation remains ongoing and no details have been released on the type or extent of information removed.
Network segmentation and incident containment actions prevented the attacker from further spreading into the infrastructure, according to the DIVD. This shows that service isolation and rapid access disruption can limit the consequences even when a support application is compromised.
DIVD had stated in its first public update that the modus operandi indicated the use of an autonomous artificial intelligence agent. In the latest update, it described that activity traces and decision logs helped reconstruct the actions, as reported by BleepingComputer. The assessment is attributed to the organization itself and should not be taken as an independent identification of the perpetrator or the tool.
The two vulnerabilities were publicly disclosed as CVE-2026-102489 and CVE-2026-102490, following a collaboration between DIVD and researchers at Merlon Security. The organization says it is scanning publicly accessible Zammad installations and notifying those responsible. The DIVD listing includes history, versions, and instructions for checking for a possible breach.
See also: RubyGems: OpenAI agents attacked the platform
What measures does DIVD propose?
DIVD recommends that users upgrade Zammad to version 7 or temporarily take the installation offline. It also says that the vendor has been notified and is working on a fix. Because the details of affected versions differ between the two CVEs, administrators should follow the latest official guidance and confirm the version they are using.
To determine if an installation has been affected by a network breach, DIVD has a special verification tool that checks Zammad logs for signs of an intrusion. The team also recommends checking for access to administrative accounts and unusual actions on servers. Any findings should be treated as an incident until the investigation is complete.
The SecNews technical team points out that request handling platforms often connect to internal services and store customer or employee information. This is why they need limited permissions for application accounts, separate boundaries between systems, and immediate revocation of active sessions after a potential breach.
🔒 Protect your privacy with Proton VPN
Swiss VPN from the creators of Proton Mail — strict no-logs policy, strong encryption, and built-in NetShield that blocks ads, trackers, & malware.
- ✔ No-logs, based in Switzerland (except 14-Eyes)
- ✔ NetShield: blocks ads, trackers & malicious domains
- ✔ Covers all devices — free version available
The link is an affiliate link — SecNews may receive a commission at no additional cost to you. It does not affect the independence of our article writing.
The incident is a reminder that even organizations with dedicated security teams can find themselves exposed when a request management service acts as a bridge to critical systems. Immediate isolation, audit of logs, and implementation of the official update remain critical steps until the implications are fully understood.
See also: Roundcube Webmail: Critical vulnerability CVE-2026-48842 is actively exploited
