The volunteers who spend their evenings warning strangers about exposed servers have spent nearly two weeks cleaning up their own. The Dutch Institute for Vulnerability Disclosure, known as DIVD, says an intruder got into the ticketing system behind its CSIRT mailbox on September 21, went from a hijacked session to root in seconds, and pulled volunteer data out before network segmentation stopped it going any further.
What sets the case apart is who, or what, DIVD believes was at the keyboard. The nonprofit says the pattern of the intrusion points to an attack run by an AI agent, and the way in was a pair of previously unknown flaws in Zammad, an open source ticketing product used by support desks. Those flaws now carry the identifiers CVE-2026-102489 and CVE-2026-102490, and on October 2 the US cybersecurity agency CISA added both to its catalog of vulnerabilities known to be exploited.
Loud, messy and fast
DIVD spotted suspicious activity on September 22, a day after the first access, cut off every system in its data center and brought in Merlon Security for the forensics. It reported the incident to the Dutch data protection authority and to NCSC-NL, the national cyber security centre, and talked to the police. By September 24 it had said publicly that the modus operandi pointed to an attack driven by an agentic AI, something it had not seen before.
The evidence it has shared is unusual. Redacted log excerpts show the attacker's scripts carrying comments in which the agent justifies its own steps, explaining why what it is doing is acceptable and not phishing, which DIVD notes no human attacker would bother with. The organization calls the attack loud and very messy: the agent chose each next move on its own, at speed and on sloppy logic, and at one point disrupted its own man in the middle attack with password spraying. The verbose comments made reverse engineering the intrusion much easier. DIVD sees no link to any known group, and nothing so far suggests it was singled out for the research data it holds, though it has not ruled that out.
Two flaws, one chain
On September 30, DIVD explained how the intruder got in. The first flaw, CVE-2026-102489, lets an unauthenticated attacker hijack user sessions on Zammad versions 6.3.0 to 6.5.4 and run code as the zammad system user. The same code exists in versions 7.0.0 to 7.1.3, but DIVD says environment conditions in those releases make it unexploitable there. The second, CVE-2026-102490, lets that local zammad user escalate to root and is present in every Zammad release, including the newest alpha. Chained, the two took the agent from a web request to full control of the server in seconds.
From the helpdesk host the intruder reached other services and moved data out before segmentation and DIVD's response stopped it going deeper. On October 1 DIVD published an inventory of the categories of data it considers at risk, with the investigation status of each. What it knows for certain is that data about volunteers left the network, including their DIVD email addresses and, possibly, other contact details, which makes impersonating a DIVD volunteer easier. The ticketing system stores the messages sent to the CSIRT mailbox and the team's replies, though not the notifications DIVD sends out first, and anyone who has corresponded with the team is told to assume the attacker may have that exchange: follow up requests about scan results, which can include the IP addresses of vulnerable systems, vulnerability reports, and excerpts from credential dumps in which the passwords were masked. DIVD says the attacker struggled to get data out of its environment, so only part of it was taken. Several other internal systems show signs of compromise or are still being examined.
Fixing it is not straightforward
Remediation is where the public record gets tangled. DIVD's case file lists a patch as available and tells administrators to upgrade to Zammad 7 or take the instance offline, while noting in the same document that Zammad is still working on a fix. As of October 1 the position was that neither flaw had a dedicated fix. Version 7 closes the remote entry point because the session leak cannot be exploited there, but the privilege escalation affects version 7 too, so an attacker who finds another way onto the box still gets root. DIVD is scanning for exposed instances and has released a script that checks Zammad log files for indicators of compromise.
Administrators should move to the 7 branch or take the server off the internet until both flaws are fixed, since 6.3.0 to 6.5.4 is the range where the remote flaw is exploitable. NCSC-NL has advised copying both application and network logs before updating, so that they can still be checked if more becomes known about how the privilege escalation was abused. Any hit from DIVD's log check script should be treated as a full compromise of the host, with every credential on it rotated.
For US federal civilian agencies there is no discretion. CISA's catalog entries for both flaws carry a remediation deadline of October 5 under its binding directive on risk based patching, which also expects agencies to check whether a system was compromised before the patch went on, and to drop the product if no mitigation is available. The question DIVD has not yet answered is whose interests the agent was serving.
