← DIVD (Dutch Institute for Vulnerability Disclosure)

2026 DIVD — agentic AI intrusion via Zammad zero-days (CVE-2026-102489/102490); data exfil

2026 Unknown records affected Share on X

Data compromised

Scope unpublished. DIVD states it cannot rule anything out and is treating the incident as worst-case assume-breach until proven otherwise. Directly involved parties informed; reported to Autoriteit Persoonsgegevens and Dutch NCSC; options discussed with police. Individual census unpublished.

Technical writeup

Verified DIVD CSIRT notice — September 24, 2026 (“It was a matter of when, not if…”). Dutch Institute for Vulnerability Disclosure detected suspicious activity, concluded it had been compromised, blocked infrastructure access, and engaged a third-party IR team. DIVD describes the modus operandi as an agentic AI-powered attack not previously seen in its experience; investigation ongoing; worst-case assume-breach posture. Directly involved parties informed; incident reported to Autoriteit Persoonsgegevens and the National Cyber Security Centre; discussed with police. Next public update scheduled Monday September 28 (or sooner). Spokesperson Marieke Rijken (communications@divd.nl). Headcount and data inventory unpublished — recordsAffected 0; companyConfirmed true. Follow-up (BleepingComputer Sep 30, 2026): DIVD attributed initial access to Zammad flaws CVE-2026-102489 and CVE-2026-102490 enabling session hijacking, remote code execution, and root escalation within seconds via agentic automation; data was read/exfiltrated; deeper lateral movement limited by segmentation. DIVD/Merlon notified Zammad; users urged to upgrade to Zammad 7 or take instances offline.

Root cause

Chain of two Zammad ticketing zero-days (session hijack + RCE/privilege escalation) exploited by an autonomous AI agent

References

Breaches you may like

Sign in to monitor vendor exposures, observe your organization's attack surface and security posture, access timely breach intelligence, provision API credentials, and run external security scans—all within one consolidated, secure workspace.

Log in →