AI-Driven Attack Exploits Zammad Zero-Days to Breach Network

The Dutch Institute for Vulnerability Disclosure (DIVD) reported that its network was breached via two zero-day vulnerabilities in the open-source Zammad ticketing system, identified as CVE-2026-102489 and CVE-2026-102490. The attack was carried out by an AI agent that autonomously hijacked sessions, executed remote code, and escalated privileges to root within seconds. The AI agent left detailed logs, allowing DIVD to reconstruct the incident. Zammad users are advised to upgrade to version 7 or take instances offline immediately to mitigate the risk.