Grade One Press

Technology reporting you can check

News · Security & privacy

Zammad flaws used to breach a security nonprofit are listed as exploited; US agencies must act by 5 October

The Dutch Institute for Vulnerability Disclosure says the attack on it in September was carried out by an AI agent. Zammad says one flaw affects only old versions and it cannot yet verify the other.

Grade One Newsroom · 1 min read

Sources: 4 · top grade 1How evidence is graded

Zammad flaws behind a breach DIVD attributes to an AI agent are now listed as exploited

Grade 1 · Primary

Source: US Cybersecurity and Infrastructure Security Agency (CISA)

What changed
CISA listed two Zammad helpdesk flaws as exploited on 2 October, with a 5 October deadline for US agencies. DIVD found them after being breached through them on 21 September.
Who it affects
Organisations running Zammad, the open-source helpdesk and ticketing system, on their own servers.
What it does not tell you
Whether the attacker really was an AI agent working alone. That is DIVD's assessment; its investigation was still open.

The full story Check the source

The US Cybersecurity and Infrastructure Security Agency added two flaws in Zammad, an open-source helpdesk system, to its catalogue of exploited vulnerabilities on 2 October. Federal agencies have until 5 October to act [1].

The flaws were found by the Dutch Institute for Vulnerability Disclosure (DIVD), a volunteer security nonprofit, after it was breached through them on 21 September [2].

DIVD says "the modus operandi indicates that this is an agentic AI powered attack": one run by an AI system acting on its own [3]. That is its assessment, made while the investigation was under way.

What it covers

CVE-2026-102489 lets an attacker hijack a session and run code as the Zammad user. CVE-2026-102490 lets that user become root, the system's administrator. CISA notes the two can be chained [1].

DIVD says the first is exploitable in Zammad 6.3.0 to 6.5.4, and the second affects versions from 1.5.0 to the latest alpha. It advises upgrading to version 7 or taking Zammad offline, and offers a script to check logs for signs of compromise [2].

Zammad disagrees in part. It says the first flaw affects only versions 6.5 and older, which are out of support, and that "We cannot verify a claim we have not been shown" about the second [4].

What it does not tell you

Whether the second flaw is fixed. DIVD lists its patch status as available; Zammad's statement announced no fix for it [2][4].

Whether an AI agent acted alone. DIVD has not published its full forensic findings [3].

How many Zammad servers were exposed or broken into. Neither DIVD nor CISA says [1][2].

Sources and their grades

  1. US Cybersecurity and Infrastructure Security Agency (CISA), Known Exploited Vulnerabilities Catalog, entries CVE-2026-102489 and CVE-2026-102490. Read 3 October 2026. Grade 1 · Primary Both added 2 October 2026, due 5 October.
  2. Dutch Institute for Vulnerability Disclosure (DIVD), DIVD-2026-00015, Vulnerabilities in Zammad during investigation of case DIVD-2026-00014. Read 3 October 2026. Grade 3 · Filed record The victim's own case page: affected versions, timeline, advice. Last modified 1 October 2026.
  3. Dutch Institute for Vulnerability Disclosure (DIVD), It was a matter of when, not if.... Read 3 October 2026. Grade 3 · Filed record DIVD's first statement on the breach, 24 September 2026.
  4. Zammad (staff post, Zammad community forum), Take care: Local Privilege Escalation (CVE-2026-102490) is reported as being actively exploited. Read 3 October 2026. Grade 3 · Filed record The maker's own statement, 1 October 2026.

A grade says how much weight a source will take, from 1 (a body that can compel an answer and has nothing to sell) to 5 (somebody describing what they sell, or themselves). The standard sets out what each grade may be used for.

Filed under Cyberattacks Vulnerabilities

Comments

Commenting needs an account, made with nothing but an email address. A first comment is read before it appears.

More news

See all