The short answer
An attacker chained two Zammad zero-days, CVE-2026-102489 and CVE-2026-102490, to go from a hijacked helpdesk session to root in seconds, and CISA now lists both as actively exploited. The victim, the Dutch Institute for Vulnerability Disclosure (DIVD), says the intrusion on 21 September 2026 was run by an autonomous AI agent. DIVD's advice is blunt: upgrade to Zammad 7 or take the instance offline.
Helpdesks are easy to underrate. They hold customer conversations, attachments, agent accounts and API tokens into CRM, email and chat, and they are usually reachable from the internet by design. A root compromise of that server is a data-breach event, not a ticketing glitch, which is why it belongs in the same review cycle as your penetration testing and security audits.
What happened at DIVD?
DIVD is a volunteer nonprofit that scans the internet for vulnerable systems and warns their owners. On 21 September 2026 an attacker went after its own Zammad instance. According to DIVD's account, reported by BleepingComputer and SecurityWeek, the attacker hijacked a session, ran code on the server, escalated from the zammad service user to root, and then reached other services and exfiltrated data. Network segmentation stopped it from going deeper.
DIVD's researchers reproduced the two flaws on 22–23 September and reported them to Zammad on 24 September. From 26 September DIVD began scanning for internet-exposed vulnerable Zammad instances and notifying their owners, and it published a script that administrators can run to check for signs of compromise. SecurityWeek reported that Zammad was working on a fix. On 2 October CISA added both CVEs to its KEV catalog.
Which Zammad versions are affected, and is there a fix?
The entry point, CVE-2026-102489, is a session fixation weakness (CWE-384). It lets a remote attacker take over a legitimate user's session and turn that into code execution as the local zammad user. It is directly exploitable in Zammad 6.3.0 through 6.5.4. The flawed code also exists in 7.0.0 through 7.1.3, but researchers say environmental conditions in those releases block exploitation. runZero reports that 7.2.0 ships security hardening that resolves it.
The second flaw, CVE-2026-102490, is the one that makes the chain dangerous: an improper privilege management bug that lets a local user become root. runZero lists a very wide affected range, which Zammad disputes, and reports that no official patch had shipped for it at the time of writing. In practice, the safest assumption is that root escalation is still possible on any version once an attacker has code execution. That makes closing the first step, by running a supported, hardened 7.x release, the control that actually matters.
Version support adds a deadline of its own. The 6.5 line and earlier are end-of-support and will not receive further security updates, so teams still on 6.x have a migration project, not a patch, in front of them.
What changes when the attacker is an AI agent?
DIVD described the intrusion as “loud and very, very messy”. It said the agent made its own decisions about next steps, moved from session hijack to root in seconds, and left comments in its attack scripts explaining those decisions. Those traces let DIVD rebuild the timeline. This is DIVD's reading of its own logs; no group has been publicly attributed.
Two things change for defenders. First, speed: when chaining and privilege escalation happen in seconds, there is no window for a person to spot an odd session and step in. Prevention and segmentation have to do the work, which is what limited the damage at DIVD. Second, scale: an agent that can find and chain bugs in a niche open-source helpdesk can do the same to any self-hosted tool you forgot was public. The assumption that “nobody targets our ticketing system” was always weak, and it is weaker now.
The same incident also gives defenders something useful. A noisy, self-documenting attacker is easier to detect and reconstruct than a careful human operator, so logging, alerting and log retention for edge applications now pay off more than they used to.
What it means for US & EU software teams
A helpdesk is a high-value target. It stores customer names, emails, attachments and conversation history, and it often holds integration tokens for email, CRM and chat. Root on that host means all of it should be treated as exposed. For EU organisations that is personal data, so a confirmed compromise can trigger the GDPR 72-hour breach-notification clock. If you are unsure how your helpdesk data maps to those duties, it is worth a GDPR compliance review before an incident rather than after one.
The KEV listing binds US federal civilian agencies, but its message applies to everyone: this is being used in attacks now. For teams under SOC 2, NIS2 or DORA, an internet-facing, known-exploited, end-of-support application touching customer data is the kind of finding auditors expect you to have inventoried and fixed on a defined timeline.
The broader lesson is about self-hosted open-source tools at the edge. Zammad is a solid product, and self-hosting it is a reasonable choice for data control. That choice comes with the duty to track advisories, keep up with major versions and keep admin surfaces off the open internet. Someone has to own that list, and with AI-driven exploitation compressing timelines, “we patch quarterly” is no longer a defensible answer for anything public.
What to do right now
- Find every Zammad instance and its version. Check containers, packages and any instance a team set up on its own. Versions 6.3.0–6.5.4 are directly exploitable.
- Upgrade to a supported 7.x release, 7.2.0 or later, or take the instance offline. This is DIVD's recommendation, and on 6.x it is the only path to security updates.
- Reduce exposure. Put the agent and admin interfaces behind SSO, VPN or an allow-list; only the customer-facing parts should be public.
- Check for compromise. Run DIVD's verification script and review sessions, new admin accounts, unexpected processes and outbound connections since at least mid-September.
- Rotate secrets. Treat API tokens, mail credentials and integration keys stored in or reachable from the helpdesk as exposed if the instance was internet-facing and unpatched.
- Track CVE-2026-102490. Subscribe to Zammad's security advisories and apply the root-escalation fix as soon as it ships.
None of this is legal advice, and your exposure depends on how Zammad is deployed. The direction is clear, though: a chain from session hijack to root, used in the wild, on a server full of customer data, is a fix-today event.
Frequently asked questions
What are CVE-2026-102489 and CVE-2026-102490 in Zammad?
They are two vulnerabilities in Zammad, the open-source helpdesk and ticketing system. CVE-2026-102489 is a session fixation flaw that lets a remote attacker hijack a user session and reach code execution as the local zammad user. CVE-2026-102490 is an improper privilege management flaw that lets a local user escalate to root. Chained, they take an attacker from the network to root on the helpdesk server.
Which Zammad versions are affected?
CVE-2026-102489 is exploitable in Zammad 6.3.0 through 6.5.4. The underlying defect is also present in 7.0.0 through 7.1.3, but researchers say it is not exploitable there because of environmental conditions, and runZero reports that 7.2.0 adds security hardening for it. CVE-2026-102490 has a much broader reported version range, which the vendor disputes. The 6.5 line and earlier are out of support.
Are the Zammad flaws being exploited?
Yes. The Dutch Institute for Vulnerability Disclosure (DIVD) says an attacker chained both flaws against its own Zammad instance on 21 September 2026, and CISA added both CVEs to its Known Exploited Vulnerabilities catalog on 2 October 2026, its signal that reliable evidence of active exploitation exists.
Why does DIVD say an AI agent carried out the attack?
DIVD says the intrusion was loud and messy, moved from session hijack to root in seconds, and showed signs of automated, iterative decision-making, including attack scripts with comments explaining the agent's own choices. Those traces let DIVD reconstruct the incident. It is DIVD's assessment based on its logs; no attacker has been publicly attributed.
What should teams running Zammad do now?
Move to a supported Zammad 7 release (7.2.0 or later) or take the instance offline, as DIVD recommends. Remove the helpdesk from direct internet exposure where possible, run DIVD's published verification script, review sessions and server logs since at least mid-September, rotate credentials and API tokens stored in or reachable from the helpdesk, and watch Zammad's security advisories for a fix for the privilege escalation flaw.
Sources
CISA — CISA Adds Two Known Exploited Vulnerabilities to Catalog, 2 October 2026 (primary source)
BleepingComputer — DIVD says Zammad zero-days enabled AI-driven network breach
SecurityWeek — Zammad Zero-Days Exploited in AI-Powered DIVD Hack
Help Net Security — AI agent used Zammad zero-days to breach Dutch vulnerability disclosure non-profit
runZero — Zammad vulnerabilities: find impacted installations