Zammad zero-days enabled DIVD network breach

The Dutch Institute for Vulnerability Disclosure (DIVD) has attributed a recent network breach to two previously unknown vulnerabilities in Zammad, an open-source ticketing platform. According to DIVD, the flaws allowed attackers to gain initial access and use AI-driven techniques to move laterally within its systems. No customer data was reported as compromised, but internal tools and vulnerability-tracking systems were exposed during the incident.

What happened

DIVD disclosed that the attack exploited a chain of two zero-day vulnerabilities in Zammad. The first flaw enabled unauthenticated remote code execution, while the second allowed privilege escalation within the application. Attackers combined these vulnerabilities with AI-based automation to accelerate reconnaissance and lateral movement. DIVD did not specify the exact timeline of the breach but confirmed it occurred before the vulnerabilities were patched. The organization has since released fixes for both flaws and urged users to update immediately.

What we don't know yet

The identity of the attackers and their motives remain unclear. DIVD has not disclosed whether the breach was financially motivated, state-sponsored, or part of a broader campaign targeting vulnerability disclosure organizations. Additionally, the extent of lateral movement within DIVD’s network and whether any sensitive vulnerability reports were accessed or exfiltrated has not been confirmed. DIVD stated its investigation is ongoing and further details may be released as they become available.