The Dutch Institute for Vulnerability Disclosure, better known as DIVD, has disclosed that attackers broke into its systems by chaining two zero-day vulnerabilities in the open-source Zammad support platform. The result was an exquisitely humiliating security vignette: the people who help disclose vulnerabilities had to disclose that vulnerability disclosure infrastructure had itself become vulnerable.
According to The Register, the bugs allowed attackers to hijack sessions, achieve remote code execution as the local zammad user, and escalate privileges to root. DIVD assigned the flaws CVE-2026-102489 and CVE-2026-102490, with chained-attack CVSS 4.0 scores of 9.4. The organization says the attackers stole data belonging to volunteer security researchers, including DIVD email addresses and potentially other contact details.
🤚 The Open-Palm Helpdesk Incident
The reported attack took place on September 21, when malicious actors compromised DIVD’s IT environment through its Zammad ticketing system. In the most elegant possible example of “the cobbler’s children have no shoes,” the compromise hit a nonprofit bug-hunting organization that is also a CVE Numbering Authority.
The technical chain is unpleasantly direct. CVE-2026-102489 enables unauthenticated attackers to leak user sessions and obtain remote code execution. CVE-2026-102490 then allows local privilege escalation to root. In practical terms, the front desk did not merely let the visitor into the lobby; it handed over the master key, the building directory, and a polite apology for any inconvenience.
The Register reports that Zammad versions 6.3.0 through 6.5.4 are vulnerable to the first flaw, and that versions 7.0.0 through 7.1.3 contain the issue but are not exploitable under the cited environmental conditions. DIVD’s guidance is blunt: users should upgrade to Zammad 7 or take Zammad offline.
👐 The Two-Handed Researcher Risk
The stolen information is especially sensitive because it concerns security volunteers. Email addresses and contact details may sound less cinematic than passwords or private keys, but in the hands of patient attackers they become social-engineering perfume: subtle, credible, and unpleasantly effective.
DIVD warned that volunteers and others face increased risk because attackers may now have enough context to impersonate someone from the organization. A message that “feels slightly off” is no longer merely awkward. It may be reconnaissance wearing a conference badge.
This is the quiet danger of breaches involving trust networks. Security organizations do not run on software alone; they run on reputations, introductions, private reports, embargoes, researcher identities, and the implicit assumption that the person asking for clarification about a flaw is not also trying to walk away with the furniture. Once attackers obtain metadata about who talks to whom, they gain material for believable lies.
🌿 The Gentle Awakening
The incident also illustrates a broader industry problem: support platforms have become privileged nerve centers. They collect bug reports, customer complaints, attachments, session details, internal notes, and occasionally the kind of operational context that makes attackers feel like they have purchased a backstage pass.
Helpdesks used to be treated like administrative plumbing. Now they are identity-adjacent, security-sensitive, automation-connected workflow engines. They touch email. They store attachments. They integrate with internal systems. They provide a human-looking doorway into organizations that otherwise imagine themselves protected by stern diagrams.
That makes patching and segmentation less glamorous but more important. A ticketing platform should not be able to become a kingdom simply because it processed a complaint. Least privilege, isolation, rapid upgrade paths, monitoring, and boring incident drills remain the unbranded luxury goods of security.
👑 The Gold-Leaf Reckoning
DIVD deserves credit for publishing details and guidance quickly rather than wrapping the whole episode in crisis-communications cashmere. The organization’s transparency gives defenders something usable: CVE identifiers, affected-version information, exploitation context, and a clear mitigation path.
But the lesson is not comfortable. Even mature security communities depend on ordinary software, and ordinary software occasionally arrives carrying a concealed orchestra of disaster. The prestige of the user does not bless the platform. The platform must still be patched, isolated, watched, and occasionally escorted out of production with firm but tasteful hands.
If you run Zammad, the message is not philosophical. Check your version, read the advisory, upgrade, investigate suspicious activity, and treat exposed contact data as future phishing infrastructure. The attackers have already attended the reception. It would be gauche to leave the wine unattended.
“A helpdesk is just a breach portal with customer-service lighting if you forget to patch it.” — The Slap of Wisdom Incident Concierge, polishing the root shell with a linen napkin