AI agent used Zammad zero-days to breach Dutch vulnerability disclosure non-profit

An agentic AI-powered attack breached the Dutch Institute for Vulnerability Disclosure (DIVD) on September 21 by exploiting two zero-day vulnerabilities in Zammad, an open-source helpdesk and customer support ticketing system. According to Help Net Security, the two flaws used together let attackers hijack sessions, run code remotely and escalate privileges from the Zammad user to root in seconds, after which they accessed other services and read data.

An agentic AI-powered attack that hit the Dutch Institute for Vulnerability Disclosure DIVD on September 21 exploited two zero-day vulnerabilities in Zammad, an open-source helpdesk and customer support ticketing system. “Used together, the two flaws allowed the attackers to hijack sessions, run code remotely and escalate privileges from the Zammad user to root, in seconds, due to the agentic part of this hack. From there they were able to access other services and read and … More https://www.helpnetsecurity.com/2026/10/01/divd-agentic-ai-attack-breach/ The post AI agent used Zammad zero-days to breach Dutch vulnerability disclosure non-profit https://www.helpnetsecurity.com/2026/10/01/divd-agentic-ai-attack-breach/ appeared first on Help Net Security https://www.helpnetsecurity.com .