On 21 September 2026 an attacker got into the network of the Dutch Institute for Vulnerability Disclosure (DIVD), the volunteer group that warns organisations about vulnerable software. The way in was DIVD's own helpdesk. DIVD's incident page says two unknown flaws in Zammad, the open-source ticketing system it ran, together allowed session hijacking, remote code execution and privilege escalation from the Zammad user to root, "in seconds due to the agentic part of this hack."
DIVD believes an AI agent ran the attack. The attacker's scripts carried notes in which the agent explains why what it is doing is fine, which a human would not bother writing. DIVD calls the attack "loud and very messy," with the agent picking each next step on its own, fast and on sloppy logic. Nobody outside DIVD has confirmed the AI part, and DIVD says it sees no link to a known threat actor. Network segmentation stopped the attacker from going deeper, but volunteer email addresses and possibly contact details got out.
What is known about the two flaws
- CVE-2026-102489 (session hijack leading to code execution as the zammad user). DIVD's case file lists Zammad 6.3.0 to 6.5.4 as exploitable, and 7.0.0 to 7.1.3 as containing the flaw but not exploitable because of environment conditions. Zammad's statement of 1 October agrees that only 6.5 and older can be exploited, notes those versions are out of support, and says the affected code was hardened in 7.2.0.
- CVE-2026-102490 (local escalation from the zammad user to root). DIVD lists v1.5.0 to v7.1.0-alpha. Zammad said on 1 October that it had only just received the technical details, was working on them, and that the flaw cannot be used remotely on its own: an attacker first needs access to the server. In its advisory of 5 October Zammad adds that the issue is related to a confirmed vulnerability in packager.io, the service its Linux packages are built with, and that a fix is in progress. Zammad 7.2.1, released on 6 October with a batch of security advisories, did not cover it. The fix shipped two days later in Zammad 7.2.2 on 8 October. The GitHub advisory lists every version up to 7.2.1 as vulnerable, but only installs from the DEB and RPM packages; source installs and the official container images were not affected.
The Dutch NCSC published an alert on 30 September saying both flaws had been actively abused since 21 September, and CISA added both to its Known Exploited Vulnerabilities catalog on 2 October 2026.
Why a helpdesk makes a good way in
A helpdesk faces the internet on purpose. Customers and staff have to reach it without a VPN. Behind that public page it holds agent sessions, the password of the support mailbox, attachments sent by strangers, and often tokens for the directory and other internal systems. Whoever gets root on that server sees a lot of the organisation.
The agentic part matters for timing. If DIVD's reading is right, the step from "public login page" to "root" took seconds, not the hours a human operator would need. A patch window measured in weeks was already risky; against tooling that chains bugs this fast it is too long. We wrote about the other side of AI agents, the tools they load, in our malicious MCP server checklist.
A checklist for any self-hosted helpdesk
- Know your version today. On Zammad, move to 7.2.2, the current release. It fixes CVE-2026-102490 and keeps the 7.2.1 fixes for a batch of other security issues published on 6 October. Zammad's advice to limit shell access to the server to trusted administrators still holds. On any product, check that you run a release that still gets security fixes.
- Copy the logs before you update. The NCSC advises this so you can check for abuse later. Zammad users can run DIVD's indicator-of-compromise script against their log files.
- Keep the agent interface off the open internet. Only the customer portal and inbound mail need to be public. Put the agent login behind a VPN, an SSO-protected reverse proxy or an IP allow-list.
- Segment the helpdesk server. It should reach only the systems it integrates with, not file shares or directory admin. DIVD credits segmentation for limiting its damage.
- Run the app with as little privilege as possible. A non-root user inside a container with no extra capabilities leaves a local root bug less to give.
- If you were exposed on an affected version, rotate what the helpdesk holds: agent sessions, API tokens, the mailbox password and integration secrets.
- Warn customers about impersonation. DIVD notes that leaked volunteer data makes it easier to pose as DIVD. A leaked ticket history does the same for anyone posing as your support team.
Where FanDesk fits
FanDesk is Fanpino's helpdesk, and we are not going to use someone else's incident to claim our code has no bugs. In September 2026 a researcher reported a stored XSS issue in FanDesk through PDF attachments, and we published what we changed. FanDesk runs in containers you can place in your own network segment, and the checklist above applies to it in the same way. See FanDesk.
FAQ
What happened to DIVD?
On 21 September 2026 an attacker used two zero-day flaws in DIVD's Zammad helpdesk to reach root and then other services. DIVD's incident page says volunteer email addresses and possibly contact details were taken.
Which Zammad versions are affected?
For CVE-2026-102489, both DIVD and Zammad say 6.5 and older can be exploited; Zammad recommends 7.2.0. For CVE-2026-102490, DIVD lists nearly all versions, and Zammad fixed it in 7.2.2 on 8 October (only DEB and RPM package installs were affected). Update to 7.2.2 and limit who can log in to the server.
Was it really an AI agent?
That is DIVD's assessment, based on scripts where the agent comments on and justifies its own actions. It has not been confirmed by anyone outside DIVD.
Does this affect helpdesks other than Zammad?
The two CVEs are specific to Zammad. The lesson is not: any helpdesk is public by design and holds sessions, mailbox credentials and integration tokens, so version, exposure and segmentation deserve the same check.
The same rule held a week later for VPN gateways: after the NetScaler zero-days, patching was only half the job and the secrets on the box had to be rotated.
