The Dutch Institute for Vulnerability Disclosure spends its time finding other organizations’ security flaws. In September 2026, it found one in its own infrastructure the hard way — by getting breached through Zammad, the open-source helpdesk platform DIVD uses to run its own operations. Investigating that breach is what turned up CVE-2026-102489 and CVE-2026-102490, a pair of bugs that, chained together, take an attacker from an anonymous network request to root access on the underlying server. DIVD’s own account of the intrusion includes a detail that’s as unsettling as the vulnerability itself: the attacker’s tooling ran the entire chain — session hijack, code execution, privilege escalation — in seconds, using an automated agent rather than a human operator working the exploit by hand.

Two bugs that were only dangerous together

CVE-2026-102489, rated CVSS 9.4 by Rapid7, is a session fixation flaw — CWE-384 — in how Zammad manages user sessions for its websocket and long-polling connections. Rapid7’s vulnerability database describes it as a session hijacking issue that leads to remote code execution in the context of the zammad service account, directly exploitable on Zammad 6.3.0 through 6.5.4, with the underlying defect also present — though not practically triggerable under normal conditions — on the 7.0.0 through 7.1.3 line. On its own, that bug hands an attacker code execution as an unprivileged service account: real, but contained.

CVE-2026-102490 is what removes the containment. It’s an improper privilege management flaw — reported across a far wider version range, 1.5.0 through 7.1.0-alpha — that lets the local zammad user escalate straight to root. Security Affairs’ reporting quotes DIVD’s own description of the pair: “used together, they allowed the attackers to hijack sessions, run code remotely and escalate privileges from the Zammad user to root.” Neither bug alone is a full server compromise. Session fixation without a privilege-escalation path just gets an attacker a low-privilege foothold; privilege escalation without remote code execution needs a foothold the attacker doesn’t have yet. Chained, they’re a complete, unauthenticated path from the network to root — which is precisely why CISA added both to its Known Exploited Vulnerabilities catalog on the same day, 2 October 2026, with a three-day remediation deadline for federal agencies under BOD 26-04.

Built to automate support tickets, not to run privileged code

Zammad is a helpdesk and ticketing platform — the kind of tool a support team uses to triage incoming requests, route them, and automate repetitive responses, with over 2,000 organizations and roughly 55,000 users on it by Security Affairs’ count. That’s precisely why the privilege-escalation half of this chain matters as much as the remote-access half: a ticketing system is not supposed to be a path to root on the server that hosts it, and the fact that one existed meant every Zammad instance running an affected version was carrying a server-takeover bug disguised as a support tool. It’s the same structural failure that showed up in Kestra’s one-word path check and JFrog Artifactory’s phantom join key earlier this year — automation platforms accumulate broad system access because their job is to act on an organization’s behalf, and a single authentication or privilege-boundary failure in that kind of tool converts all of that delegated access into an attacker’s.

The part that should worry defenders more than the CVE

What DIVD’s account adds that a standard advisory wouldn’t is the exploit’s speed. Security Affairs reports that the full chain — from the initial session hijack through code execution to root — ran in a matter of seconds, attributed to the attacker automating the exploit with an AI agent rather than executing each step manually. A human operator working a two-stage chain by hand has natural pauses: confirming the first stage worked before attempting the second, adjusting for an unexpected response, moving at the speed of someone reading output and typing commands. An automated agent collapses all of that into a single uninterrupted execution, which matters directly for detection: security monitoring built around noticing a pause between “suspicious session activity” and “privilege escalation attempt” — the kind of gap that gives a SOC analyst time to intervene — assumes a gap that an AI-driven exploit simply doesn’t leave.

A patch for one bug, not the other

Zammad’s fix for CVE-2026-102489 shipped in version 7.2.0, which runZero’s advisory on finding impacted Zammad installations describes as including hardening that closes the session-fixation path. CVE-2026-102490 — the privilege-escalation half of the chain — had no official patch at the time CISA added both bugs to the KEV catalog, which means upgrading to 7.2.0 closes the entry point but, by runZero’s account, doesn’t fully close the path to root for an attacker who finds another way to reach the zammad account first. For asset-discovery teams trying to find exposure before attackers do, runZero published a fingerprinting query — matching Zammad’s default favicon hash over HTTP — specifically because self-hosted helpdesk instances are exactly the kind of internal tool that an organization’s own asset inventory tends to miss.

The lessons that generalise

A support ticketing tool is still a server, and needs to be patched like one. Organizations tend to triage vulnerability patching by how sensitive a system’s data is. A helpdesk platform holding customer support transcripts doesn’t look like a crown-jewel system — until a chained bug turns it into root access on whatever server it runs on, at which point its data sensitivity was never the relevant risk.

Two “contained” bugs are a false sense of security if they were never tested together. Session fixation to an unprivileged account and local privilege escalation to root might each get triaged as moderate on their own. CISA’s KEV entry explicitly calls out that the two “can be chained” — the kind of finding that only comes from asking what an attacker gains by combining known-low findings, not from scoring each in isolation.

AI-automated exploitation compresses the detection window to near zero. A monitoring strategy that relies on human reaction time between exploit stages is built for a threat model that’s already outdated for chains simple enough to automate end-to-end. Defenses need to assume the entire chain can execute before any human notices the first stage.

The people who find other organizations’ vulnerabilities are not exempt from having their own. DIVD discovered this chain by investigating a breach of its own systems, not by auditing someone else’s. Running security-conscious infrastructure doesn’t substitute for patching the same software everyone else runs — a vulnerability-disclosure nonprofit is just as exposed to an unpatched helpdesk server as any of the organizations whose flaws it reports.

Tech-Bee is an independent technology publication. This piece is drawn from CISA’s Known Exploited Vulnerabilities catalog entries for CVE-2026-102489 and CVE-2026-102490, Security Affairs’ reporting on DIVD’s breach investigation, and vulnerability data published by Rapid7 and runZero.