Case divd-zammad-agentic-ai-attackAI-assisted malwareNetherlands
Agentic AI attack exploits Zammad zero-days against Dutch vulnerability disclosure institute
AI agents chained two Zammad zero-days for session hijacking, code execution and root escalation within seconds, stealing email addresses from DIVD.
MediumAttack using AIStatus: Under investigationVerified case file
Open in the interactive mapCite this case
- Reported
- Oct 14, 2026
- Location
- Netherlands
- Target
- Dutch Institute for Vulnerability Disclosure (DIVD)
- Severity
- Medium
- Triggered by
- Unknown
- Actor type
- Unknown
- Reported loss
- None reported
- CVE
- None
What happened
AI agents chained two Zammad zero-days for session hijacking, code execution and root escalation within seconds, stealing email addresses from DIVD.
Impact: Email addresses were stolen from the security research organisation.
Who triggered it
Actor: Unknown
Attribution: Not stated in the headline or summary; DIVD describes the attack as agentic-AI powered.
Motive: Unknown
How it happened
Attack vector: Chained Zammad zero-day flaws enabling session hijacking, code execution and root privilege escalation, driven by AI agents.
Root cause: Two previously unknown flaws in the Zammad helpdesk software were exploited.
Timeline
- Reported by Infosecurity Magazine
Response
DIVD publicly disclosed the attack and the Zammad zero-days.
Current status: Under investigation
Sources (open in a new tab)
- Infosecurity Magazine infosecurity-magazine.com
Cite this case
Agentic AI attack exploits Zammad zero-days against Dutch vulnerability disclosure institute. AI Threat Watch, case divd-zammad-agentic-ai-attack, Oct 14, 2026. https://aithreat.io/cases/divd-zammad-agentic-ai-attack/
Permanent link: https://aithreat.io/cases/divd-zammad-agentic-ai-attack/