It is a slightly delicious irony that the organisation whose job is to tell other people about their holes was the one to be walked through one. SecurityWeek reports that DIVD, the Dutch Institute for Vulnerability Disclosure, was hit on 21 September through its Zammad ticketing system, and announced it on 24 and 30 September. Credit to them for saying so plainly.
Two bugs, one chain
Per SecurityWeek, CVE-2026-102489 (CVSS 9.4) gives an unauthenticated attacker remote code execution and leaks user sessions. CVE-2026-102490 (also 9.4) is a local privilege escalation to root. Alone, the second needs a foothold. Together they need nothing: hijack a session, run code as the Zammad user, climb to root. DIVD's description is that the attacker did this "in seconds", which it attributes to an agentic, AI-driven tool rather than a person at a keyboard.
Who is exposed
Zammad 6.3.0 through 6.5.4 are vulnerable. Versions 7.0.0 to 7.1.3 contain the defect but, according to the report, cannot be exploited given how they run. DIVD's advice is blunt: move to version 7, or take the instance offline. It has also released a script to check for indicators of compromise and has been scanning for exposed instances and warning their owners.
The detail worth stealing
The attackers did pivot from the helpdesk to other services and pulled data out. They were contained, SecurityWeek says, by network segmentation. A ticketing system is full of things people paste in without thinking - passwords, screenshots, customer details - and it usually sits somewhere with generous access to everything else. Segmentation is the unglamorous reason this story is not worse.
What to do this week
- Find every Zammad install, including the forgotten one a team stood up for a project. Check the version.
- On 6.x, upgrade to 7 or take it off the internet until you can. Do not wait for a convenient window.
- Run DIVD's verification script and review sessions and admin activity from 21 September onwards.
- Assume anything stored in tickets could be read. Rotate credentials people have pasted into them.
- Check what your helpdesk host can reach. If the answer is "most of the estate", that is the real finding.
The speed is the lesson. A chain that once needed a skilled operator and an afternoon now runs unattended, so the gap between disclosure and exploitation is shrinking toward nothing. If you want help finding the services in your estate nobody is patching, email sales@halfteck.com.