Dutch Institute for Vulnerability Disclosure Breached via Zammad 0-Days

DIVD reported a breach on 2026-09-21 in which attackers exploited two previously unknown Zammad vulnerabilities (CVE-2026-102489 and CVE-2026-102490) to hijack sessions, execute code as the 'zammad' user, escalate to root and exfiltrate volunteer contact information and CSIRT ticket contents; the intrusion was rapid and automated and was described by DIVD as an agentic AI-powered attack, while Zammad disputes parts of the disclosure and recommends upgrading to version 7.2.0 or taking affected instances offline.