#CVE2026102489
LightNews LightNews
thedailytechfeed.com
Zammad bugs CVE-2026-102489 & 102490 are being abused—outdated versions risk full server compromise. #SecurityAlert #Zammad #CVE2026102489 #PrivilegeEscalation #ServerSecurity #CISA https://thedailytechfeed.com/zammad-flaws-cve-2026-102489-cve-2026-102490-real-world-exploits-worry-cisa/
October 5, 2026 at 9:04 AM
securityonline.bsky.social
Two Zammad zero-day flaws let attackers go from session hijack to root in seconds at DIVD. See the CVEs, affected versions, and fixes.

#Zammad #ZeroDay #DIVD #CVE2026102489 #CVE2026102490 #AgenticAI #RootAccess #CyberSecurity
Zammad Zero-Day Flaws Gave Hackers Root Access at DIVD
Two Unknown Bugs Became Full Server Control Two unknown vulnerabilities turned the Zammad support system into an entry point with full control of the server. The Dutch Institute for Vulnerability Disclosure (DIVD) revealed the attack in its DIVD case record. On September 21, attackers broke into its infrastructure through a chain of zero-days. Within seconds, they moved from session hijacking to code execution.
meterpreter.org
October 5, 2026 at 7:23 AM
securityonline.bsky.social
Attackers exploited Zammad zero-day flaws CVE-2026-102489 and CVE-2026-102490 to gain root at DIVD. Upgrade to Zammad 7 or go offline.

#Zammad #ZeroDay #CVE2026102489 #CVE2026102490 #DIVD #AIAgent #ExploitedInTheWild
Zammad Zero-Day Chain CVE-2026-102489 Exploited in the Wild in AI-Driven DIVD Breach
TL;DR Attackers chained two Zammad zero-day flaws to break into the Dutch Institute for Vulnerability Disclosure (DIVD) on September 21. The pair, CVE-2026-102489 and CVE-2026-102490, took the intruders from a hijacked session to root in seconds. DIVD says the attack looked like the work of an agentic AI, and it urges every Zammad user to upgrade to version 7 or take the system…
securityonline.info
October 2, 2026 at 3:54 AM