{
 "public_id": "AIR-2026-0268",
 "incident_id": "2026-10-divd-zammad-agent-breach",
 "date_disclosed": "2026-10-01",
 "date_occurred": "2026-09-21",
 "title": "DIVD breached by what it judges to be an autonomous AI agent chaining two Zammad zero-days",
 "class": "in_the_wild",
 "attack_surface": "autonomous_ops",
 "initial_vector": "zero_day_chain_session_hijack_to_rce_to_root",
 "agent_capability_abused": [
  "autonomous_exploitation",
  "privilege_escalation",
  "password_spraying",
  "data_exfiltration",
  "autonomous_planning"
 ],
 "target_product": "Zammad helpdesk (DIVD instance)",
 "target_vendor": "Dutch Institute for Vulnerability Disclosure / Zammad GmbH",
 "autonomy_level": "fully_autonomous",
 "impact_realized": true,
 "impact_type": [
  "unauthorized_access",
  "data_exfiltration"
 ],
 "blast_radius": "DIVD internal systems; spread limited by network segmentation; full scope of accessed data still under investigation",
 "cve": [
  "CVE-2026-102489",
  "CVE-2026-102490"
 ],
 "taxonomy": {
  "owasp_asi": [
   "ASI03"
  ],
  "mitre_atlas": [],
  "labels": [
   "zero_day",
   "agent_initiated_intrusion",
   "machine_speed",
   "attribution_by_victim"
  ]
 },
 "defense_present": "network segmentation; incident response",
 "defense_bypassed": true,
 "fix_shipped": "Zammad 7 recommended; patch available per DIVD case page",
 "primary_sources": [
  "https://csirt.divd.nl/cases/DIVD-2026-00014/",
  "https://csirt.divd.nl/cases/DIVD-2026-00015/",
  "https://www.helpnetsecurity.com/?p=386522",
  "https://www.sysdig.com/blog/ai-agent-exploits-zammad-zero-days-in-divd-breach-what-we-know-and-how-to-detect-it"
 ],
 "verified_quote": "The modus operandi indicates an agentic AI powered attack, something we had not seen before.",
 "confidence": "high",
 "notes": "The agent attribution is DIVD's own judgement from observed behaviour, not independently proven; no human operator or group has been identified. DIVD's own incident page carries the quote above in its first public statement, and a later statement says the agent worked automated and decided each next step itself at speed, with its own over-explaining comments in the attacker's scripts supporting the assessment. DIVD's separate case page for the two Zammad vulnerabilities documents the flaws and the 21 September breach date but does not itself make the agent claim. The session-hijack remote code execution and root privilege escalation are confirmed by DIVD's incident page (CVSS 9.4 per press). Realized impact: DIVD states volunteer data got out, such as email addresses and possibly contact details, and that signs of compromise are still being investigated; which data and whose is not yet fully known. Spread was limited by network segmentation. Help Net Security and Sysdig's write-up repeat DIVD's characterisation.",
 "risk_category": "security_fraud",
 "risk_secondary": [
  "privacy"
 ],
 "risk_subcategory": "Remote Code Execution & Sandbox Escape",
 "risk_sub_secondary": [
  "Unauthorized Access & Account Takeover",
  "Over-permissioned execution & lateral movement"
 ],
 "ai_entity": "generative",
 "agency": "agent_acted",
 "agency_debatable": true,
 "agency_reason": "DIVD judges the intruder to be an autonomous agent chaining two zero-days; the attribution is DIVD's own assessment",
 "vector_family": "conventional_vulnerability",
 "vector_detail": "zero_day_chain_session_hijack_to_rce_to_root",
 "guardrail_kind": [
  "unknown"
 ],
 "guardrail_outcome": "silent",
 "xrefs": {
  "aiid": [],
  "atlas": [],
  "cve": [
   "CVE-2026-102489",
   "CVE-2026-102490"
  ],
  "ghsa": []
 },
 "primary_asi": "ASI03",
 "agent_framework": "unknown",
 "model_provider": "unknown",
 "model_name": "",
 "detection_mechanism": "unknown",
 "tool_access": "unknown",
 "financial_loss_band": "unknown",
 "eai_category": "privilege_escalation",
 "eai_domain": "access_control_and_permissions",
 "eai_secondary": [
  "data_exfiltration_channels"
 ],
 "eai_reason": "subcategory: Remote Code Execution & Sandbox Escape",
 "asi_curated": [],
 "asi_scope": "in_scope",
 "asi_provenance": "rule",
 "asi_reason": "ASI03 (signal=identity)",
 "submitted_by": "EAI Internal"
}