Zammad

Zammad has issued a security alert for CVE-2026-102489, a session hijacking vulnerability that can lead to remote code execution as the Zammad service account on affected older installations. DIVD reports that the flaw has already been exploited in a real-world incident, prompting urgent calls for administrators to update their systems.

The Dutch Institute for Vulnerability Disclosure (DIVD), a Dutch non-profit that coordinates the reporting of security flaws, has itself been breached through zero-day vulnerabilities in the open-source customer support platform Zammad. Attackers exploited previously unknown flaws to gain access, prompting an investigation and disclosures by the institute. The incident is drawing attention because an organisation dedicated to finding and reporting vulnerabilities was compromised through unpatched zero-days in third-party software it relied on.