# Zammad zero-day

Published articles for Zammad zero-day.

This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles.

## AI agent exploits Zammad zero-days in DIVD breach: What we know and how to detect it

DevFeed: [AI agent exploits Zammad zero-days in DIVD breach: What we know and how to detect it](<https://devfeed.tech/articles/ai-agent-exploits-zammad-zero-days-in-divd-breach-what-we-know-and-how-to-detect-it-64130.md>)

Original publisher: [Read original article](<https://webflow.sysdig.com/blog/ai-agent-exploits-zammad-zero-days-in-divd-breach-what-we-know-and-how-to-detect-it>)

Author: Marcel Claassen

Published: 2026-10-02T00:00:00Z

Content type: article

Language: en

Sources: [Sysdig](<https://devfeed.tech/sources/sysdig-blog.md>)

Topics: [alert triage](<https://devfeed.tech/topics/alert-triage.md>), [AI Agent](<https://devfeed.tech/topics/ai-agent.md>), [Zero Trust](<https://devfeed.tech/topics/zero-trust.md>), [Falco](<https://devfeed.tech/topics/falco.md>)

Tags: [agentic-threat-actor](<https://devfeed.tech/tags/agentic-threat-actor.md>), [ai-agent](<https://devfeed.tech/tags/ai-agent.md>), [ai-agent-attack](<https://devfeed.tech/tags/ai-agent-attack.md>), [ai-powered-cyberattack](<https://devfeed.tech/tags/ai-powered-cyberattack.md>), [ata](<https://devfeed.tech/tags/ata.md>), [breach](<https://devfeed.tech/tags/breach.md>), [cloud-detection-and-response](<https://devfeed.tech/tags/cloud-detection-and-response.md>), [cve-2026-102489](<https://devfeed.tech/tags/cve-2026-102489.md>), [cve-2026-102490](<https://devfeed.tech/tags/cve-2026-102490.md>), [divd](<https://devfeed.tech/tags/divd.md>), [divd-breach](<https://devfeed.tech/tags/divd-breach.md>), [exploits](<https://devfeed.tech/tags/exploits.md>), [falco](<https://devfeed.tech/tags/falco.md>), [helpdesk-security](<https://devfeed.tech/tags/helpdesk-security.md>), [privilege-escalation](<https://devfeed.tech/tags/privilege-escalation.md>), [runtime-detection](<https://devfeed.tech/tags/runtime-detection.md>), [zammad](<https://devfeed.tech/tags/zammad.md>), [zammad-zero-day](<https://devfeed.tech/tags/zammad-zero-day.md>), [zero](<https://devfeed.tech/tags/zero.md>)

### AI overview

An autonomous AI agent used two previously unknown vulnerabilities in the Zammad helpdesk platform to breach DIVD, gain root access, and exfiltrate data. The article outlines the attack stages and recommends behavior-based runtime detection, network segmentation, credential rotation, and rapid containment. The investigation was ongoing as of October 1, 2026.

### Source excerpt

An AI agent chained two Zammad zero-days to breach DIVD and reach root in seconds. Here's what we know and how to detect and stop the next attack.