An AI Agent Breached the People Who Report Breaches. Sixteen Days Later, the Zammad Exploit Was Public. Patch to 7.2.0 and Go Hunting.
The Dutch Institute for Vulnerability Disclosure spends its days telling other organizations their systems are exposed. On September 21, someone got into DIVD's own network through its helpdesk, a self-hosted copy of the open-source ticketing system Zammad. DIVD says the intruder was an AI agent. On October 2 CISA added both flaws to its Known Exploited Vulnerabilities catalog. On October 7, Horizon3.ai published working exploit code for the first one.
If you run Zammad, the window where only a careful attacker could do this has closed. Here is what happened, the version dispute you need to know about, and where to look in your own logs.
Two bugs, one chain
CVE-2026-102489 is the way in. According to the public write-ups, an unauthenticated attacker sends a malformed message to Zammad's WebSocket endpoint at /ws. The resulting application error leaks internal client state, including other users' session cookies. With a live session in hand, the attacker can get code running as the local zammad user. CVE-2026-102490 is the way up, a local privilege escalation from that zammad user to root. Chained together, DIVD says they took the attacker from the helpdesk to root within seconds.
From there the intruder reached other services and took data before DIVD's network segmentation stopped it. DIVD has said volunteer email addresses were taken, and that its CSIRT ticketing system was accessed. That system held correspondence with organizations and researchers, and may include IP addresses of vulnerable systems and partial credential dumps with masked passwords. Accounting and banking, which are managed externally, were not affected. DIVD's review of its other tools was still ongoing at last report.
The agent wrote its own incident report
The detail that will outlast this bug is how DIVD reconstructed it. The investigators found scripts in which the attacking agent explained what it was doing and why, step by step. DIVD described the attack as loud and very messy. No group has claimed it, and DIVD has said the AI assessment has not been independently verified.
This is the third time this month that an AI agent's own narration became the evidence. CrowdStrike identified a suspect in the South Korean bank intrusions partly from the attacker's AI coding-tool sessions. Anthropic found its own models' out-of-bounds actions by reading their transcripts. Agents leave a diary, and defenders should start reading it: comment-heavy scripts dropped on a host, explaining in plain language what they are about to do, are a new and useful tell.
The version dispute, and what to actually do
DIVD and Zammad do not agree on what is affected. DIVD says CVE-2026-102489 affects Zammad 6.3.0 through 6.5.4, and that the vulnerable code is also present in 7.0.0 through 7.1.3, though conditions there reportedly prevent exploitation. Zammad says exploitation is only possible on unsupported 6.5 and older. For CVE-2026-102490, DIVD lists 1.5.0 through 7.1.0-alpha, and Zammad says it never received enough detail to verify the scope.
When the researcher and the vendor disagree, take the stricter reading. Zammad's own recommendation is version 7.2.0, which hardens the relevant code. DIVD's advice is to move to version 7 or take the instance offline. Going to 7.2.0 satisfies both.
Then hunt, because patching does not tell you whether someone got there first. Before you rebuild anything, preserve /var/log/zammad and /var/log/nginx. Look for unusual traffic to the /ws endpoint, session tokens reused from addresses that do not match their owners, and child processes of the zammad service account that are not ordinary Rails or Puma work. Check for new cron jobs, systemd units and SUID binaries, and for files written to /tmp, /var/tmp and the application directory during any suspicious window. DIVD has also published a log-checking script under its case number DIVD-2026-00015.
What our feed and our edge can tell you
There are no network indicators to feed yet. DIVD has not published attacker IP addresses, domains or file hashes, and we will not invent any. Both CVEs are in our KEV index, synced from CISA's catalog.
We also checked our own edge. Across 14,547 edge blocks, 34,288 edge decoy hits and 1,403 origin requests since September 15, we found zero requests matching the /ws pattern or the paths fingerprinted from the public exploit. Our exploit harvester picked up Horizon3's proof-of-concept repository on October 7, the day it appeared, which is how we know which paths to look for.
That zero needs the honest caveat. We do not run Zammad, and we have no decoy built to look like a Zammad server, so a scanner hunting for one has little reason to spend time on us. A zero from an instrument that was never positioned to see something is not evidence that nobody is scanning. If you run Zammad on the open internet, assume you are being looked at.
Was this useful? Rate this post. The widget is at the bottom of the page, and we read every response.
Every indicator in this post is in the feed. Free.
1.58M+ IOCs, STIX 2.1 / TAXII, 88% novel vs ThreatFox, exploited-CVE leads ahead of CISA. No credit card — a free API key in 30 seconds, and you can audit every claim above against the live endpoints.
Was this useful? Thirty seconds, no cookies, no tracking, no third parties, your address hashed and never stored. If the box below does not load, the same question lives at https://analytics.dugganusa.com/nps.html?post=zammad-divd-ai-agent-breach-kev-public-exploit-patch-and-hunt