2026-09-21
HighPrimaryDIVD says an attacker used AI agents after chaining two Zammad zero-days and reaching root, with confirmed partial data exfiltration from its environment.
What happened
After the attacker chained two Zammad vulnerabilities and escalated to root, AI agents participated in the subsequent attack across DIVD's environment; DIVD found signs of partial data exfiltration and confirmed exfiltration of user data.
Why it matters
Compromise of DIVD's ticketing server, root access, access to adjacent operational services, and confirmed or suspected partial exfiltration involving DIVD email addresses, CSIRT correspondence, project-support data, and system data. DIVD reported no indication that its separate CVE/CNA environment was accessed.
Missing authorization check
An independently hosted authorization boundary for privileged session use, cross-service access, sensitive reads, and data export that cannot be bypassed by root access on the compromised application host.
Would PP block it?
The initial intrusion remains outside coverage. For services integrated behind an independent Tool-Call or Credential Gate, the attacker or agent would need a valid receipt bound to the exact identity, resource, action, and expiry before using privileged credentials, reading protected datasets, or exporting data.
Incident analysis
2026-09-21
A malicious actor breaches DIVD's Zammad instance using two zero-day vulnerabilities and escalates to root.
2026-09-21
DIVD says the actor then uses AI agents for the further attack; monitoring produces the first signal within minutes.
2026-09-22
DIVD forms an incident-response team and begins forensic investigation.
2026-09-30
DIVD publicly identifies CVE-2026-102489 and CVE-2026-102490 and reports the agentic post-compromise activity.
2026-10-09
DIVD's updated data review confirms exfiltration of user data and continued investigation into affected CSIRT and operational data.
Authorization boundary
This incident is categorized as Credential exposure. The relevant Permission Protocol gate is Tool-Call Gate. The read is conditional: the block only applies where the real action boundary is routed through a gate.
Permission Protocol would not have prevented the Zammad zero-day exploitation or root compromise, but a gate enforced outside the compromised host could deny unapproved cross-service actions and exports.
Start small
This incident maps to Tool-Call Gate. Start with the boundary that controls the actual action, then require a signed receipt before execution.