Summary
The Dutch Institute for Vulnerability Disclosure (DIVD) has published coordinated disclosure of two zero-day vulnerabilities in Zammad, a widely deployed open-source helpdesk platform, that were exploited in a breach in which the attacker used an AI agent to conduct autonomous lateral movement. CVE-2026-41881 (CVSS 9.1) allows unauthenticated remote code execution through Zammad’s ticket creation API. CVE-2026-41882 (CVSS 8.4) allows any authenticated user to escalate to system administrator within Zammad. The two CVEs were chained for initial access, then the attacker deployed an AI agent for autonomous post-exploitation. Zammad 6.5.1 patches both vulnerabilities.
Timeline
| Date | Event |
|---|---|
| August 2026 | Victim breached via Zammad CVEs; AI agent deployed for lateral movement; DIVD notified |
| September 2026 | DIVD coordinates disclosure with Zammad; Zammad 6.5.1 patches both CVEs |
| Sep 29, 2026 | DIVD publishes full disclosure; BleepingComputer reports AI-driven lateral movement detail |
What Happened
CVE-2026-41881 is an unauthenticated RCE in Zammad’s ticket creation API. The endpoint fails to sanitize input in the attachment handling component, allowing an attacker to submit a crafted ticket triggering server-side code execution. The endpoint is publicly accessible by design — Zammad is built to receive tickets from unauthenticated users — so there is no authentication barrier to exploitation.
CVE-2026-41882 is a privilege escalation in Zammad’s role assignment logic. Any authenticated user can exploit a permission validation flaw to modify their own role assignments and escalate to administrator. Chained after CVE-2026-41881, this gives the attacker full administrative access to the helpdesk including all ticket history, customer data, internal notes, and any credentials shared through the support channel.
After establishing access and escalating, the attacker deployed an AI agent to the compromised server. The agent conducted autonomous network reconnaissance, identified additional services accessible from the Zammad server’s network position, and attempted credential-based lateral movement without operator direction. DIVD assessed the AI agent as operating from a pre-configured goal statement, consistent with autonomous attack agent architecture documented in TTO-2026-0919-143 (JADEPUFFER) and TTO-2026-0926-172 (autonomous botnet C2).
Domain Intelligence
zammad.org — 62.61
zammad.org scores in the low-trust range at 62.61. Zammad is the vendor of the affected helpdesk platform and the party that patched both CVEs in version 6.5.1.