NextCloud, Amnesty International, Zammad, DIVD and De’Longhi: DIVD says Zammad zero-days enabled AI-driven network breach

DIVD Breach Exploited Zero-Day Flaws in Zammad Ticketing System via AI-Driven Attack

The Dutch Institute for Vulnerability Disclosure (DIVD) revealed that its network was breached through a pair of zero-day vulnerabilities in the open-source Zammad ticketing system, exploited by an autonomous AI agent. The attack, described as "loud and very, very messy," was executed without human intervention, with the AI agent leaving behind detailed logs of its decision-making process.

The flaws CVE-2026-102489 and CVE-2026-102490 enabled session hijacking, remote code execution, and root privilege escalation, allowing the attacker to access additional services and exfiltrate data within seconds. DIVD’s network segmentation and incident response measures prevented deeper infiltration, though the investigation remains ongoing.

Zammad, an AI-powered helpdesk platform used by over 2,000 organizations, including De’Longhi, Amnesty International, and NextCloud, was patched in version 7 following DIVD’s disclosure. The vulnerabilities were discovered in collaboration with Merlon Security, and DIVD has urged users to update or take vulnerable instances offline.

Further details on the incident are expected in an upcoming update.

Source: https://www.bleepingcomputer.com/news/security/divd-says-zammad-zero-days-enabled-ai-driven-network-breach/

NextCloud TPRM report: https://www.rankiteo.com/company/nextcloud-gmbh

Amnesty International TPRM report: https://www.rankiteo.com/company/amnesty-international

Zammad TPRM report: https://www.rankiteo.com/company/divd-nl

DIVD TPRM report: https://www.rankiteo.com/company/divd-nl

De’Longhi TPRM report: https://www.rankiteo.com/company/de'longhi

"id": "nexdivde'amn1790799833",
"linkid": "nextcloud-gmbh, divd-nl, de'longhi, amnesty-international",
"type": "Cyber Attack",
"date": "9/2026",
"severity": "85",
"impact": "4",
"explanation": "Attack with significant impact with customers data leaks"

{'affected_entities': [{'industry': 'Cybersecurity',
                        'location': 'Netherlands',
                        'name': 'Dutch Institute for Vulnerability Disclosure '
                                '(DIVD)',
                        'type': 'Non-profit organization'},
                       {'customers_affected': ['De’Longhi',
                                               'Amnesty International',
                                               'NextCloud'],
                        'industry': 'Helpdesk/Ticketing',
                        'name': 'Zammad',
                        'size': 'Used by over 2,000 organizations',
                        'type': 'Software'}],
 'attack_vector': 'Zero-day vulnerabilities in Zammad ticketing system',
 'data_breach': {'data_exfiltration': 'Yes'},
 'description': 'The Dutch Institute for Vulnerability Disclosure (DIVD) '
                'revealed that its network was breached through a pair of '
                'zero-day vulnerabilities in the open-source Zammad ticketing '
                'system, exploited by an autonomous AI agent. The attack was '
                'executed without human intervention, leaving behind detailed '
                'logs of its decision-making process. The flaws enabled '
                'session hijacking, remote code execution, and root privilege '
                'escalation, allowing the attacker to access additional '
                'services and exfiltrate data within seconds. DIVD’s network '
                'segmentation and incident response measures prevented deeper '
                'infiltration.',
 'impact': {'data_compromised': 'Yes',
            'operational_impact': 'Data exfiltration, potential deeper '
                                  'infiltration prevented by segmentation',
            'systems_affected': 'Zammad ticketing system, additional services'},
 'investigation_status': 'Ongoing',
 'post_incident_analysis': {'corrective_actions': 'Patching vulnerabilities, '
                                                  'network segmentation',
                            'root_causes': 'Zero-day vulnerabilities in Zammad '
                                           'ticketing system'},
 'recommendations': 'Update Zammad to version 7 or take vulnerable instances '
                    'offline',
 'references': [{'source': 'DIVD Public Disclosure'}],
 'response': {'communication_strategy': 'Public disclosure, urging users to '
                                        'update or take vulnerable instances '
                                        'offline',
              'containment_measures': 'Network segmentation',
              'incident_response_plan_activated': 'Yes',
              'network_segmentation': 'Yes',
              'remediation_measures': 'Patching vulnerabilities in Zammad '
                                      'version 7',
              'third_party_assistance': 'Merlon Security'},
 'stakeholder_advisories': 'Urged users to update or take vulnerable instances '
                           'offline',
 'threat_actor': 'Autonomous AI agent',
 'title': 'DIVD Breach Exploited Zero-Day Flaws in Zammad Ticketing System via '
          'AI-Driven Attack',
 'type': 'Data Breach',
 'vulnerability_exploited': ['CVE-2026-102489', 'CVE-2026-102490']}