As cited
Copy frozen at (site build).
vulnerabilities
Zammad CVE-2026-102489: Session Leak to RCE
The Dutch Institute for Vulnerability Disclosure (DIVD) disclosed a security incident on September 24, 2026, that they attributed to an agentic artificial intelligence (AI) powered attack. The initial breach originated from Zammad, a helpdesk and ticketing application, which contains CVE-2026-102489. Forensic analysis during incident response led the DIVD to connect the compromise to the agentic AI attack vector.
Why it matters: Organizations running Zammad face exploitation risk from CVE-2026-102489 (CVSS 9.4), which is listed on the Known Exploited Vulnerabilities (KEV) catalog; patching or isolating affected instances should be prioritized today.
- Source published
- First seen by Cybersecurity Tracker