Two Zero-Days Exploited in Attack on Dutch Institute for Vulnerability Disclosure

A Dutch non-profit (DIVD) was compromised by an agentic AI-driven attack that chained two zero-day Zammad vulnerabilities—CVE-2026-102489 (RCE) and CVE-2026-102490 (privilege escalation)—allowing session hijacking, remote code execution and escalation to root in seconds; attackers accessed other services and exfiltrated volunteer email/contact data. DIVD contained further damage through network segmentation and incident response; the organization urges all Zammad users to update to version 7 or take the platform offline due to the high-severity chained CVSS (9.4) and active exploitation.