Severity moderate: no source gives a fact that decides the level; we set it from the description
Happened 2026-09-21 · Earliest source we hold 2026-10-04, 13 days later
An agentic AI-powered attack hit the Dutch Institute for Vulnerability Disclosure (DIVD) on September 21, exploiting two zero-day vulnerabilities in Zammad, an open-source helpdesk and customer support ticketing system.
Risk grouping: Not yet classified
No source we hold states: who caused it, intended or not, before or after release, the ai's part.
The story
1 · What it was doingAn agentic AI-powered attack targeted the Dutch Institute for Vulnerability Disclosure (DIVD), exploiting two zero-day vulnerabilities in Zammad, an open-source helpdesk and customer support ticketing system.
2 · What went wrongThe agentic AI-powered attack exploited two zero-day vulnerabilities in Zammad, breaching the helpdesk and customer support ticketing system.
3 · What it reached or didThe attack hit the Dutch Institute for Vulnerability Disclosure (DIVD) and its Zammad helpdesk and customer support ticketing system.