Zammad · Zero-Day · CISA KEV · Active Exploitation
CVE-2026-102489 & CVE-2026-102490: An AI Agent Chained These Zammad Zero-Days to Breach DIVD
DIVD, the nonprofit that discloses vulnerabilities for a living, was breached through its own Zammad helpdesk in what it calls an agentic AI-powered attack chaining CVE-2026-102489 and CVE-2026-102490. The RCE half is patchable. The root-level flaw still has no fix.