DIVD. The access path.
An autonomous agent chained two Zammad zero-days and reached root in seconds. DIVD own description of the attack: loud, very messy, and visibly automated.
The record
Entry point. internet facing Zammad helpdesk, unauthenticated remote code execution, CVE-2026-102489.
The identity in the middle. The Zammad application own service user on the host, escalated to root. DIVD has not disclosed which internal accounts the password spraying obtained.
What was reached. other internal services, data exfiltrated before network segmentation contained it.
An autonomous agent chained two Zammad zero-days and reached root in seconds.
The path, step by step.
Taken from the published reporting. Nothing here is reconstructed.
| Step | Role in the path | What the reporting records |
|---|---|---|
| internet facing Zammad helpdesk | Entry | unauthenticated remote code execution, CVE-2026-102489 |
| Zammad service user | Step | escalation to root on the host, CVE-2026-102490 |
| internal network | Step | autonomous lateral movement, with password spraying polluting its own interception |
| other internal services | Reached | data exfiltrated before network segmentation contained it |
Where a breakpoint would have been
The service user. Both flaws were unknown on the day, so patching was not an option. What was available was the distance between an internet facing helpdesk service account and root on the same host.
A breakpoint is the single change that closes a path with the least disruption. Read how that is chosen in the breakpoint page.
4 steps from entry to data.
Where this comes from.
Every field on this page is taken from the published reporting below. The breakpoint assessment is Elmoz reading that path, not a statement about what the affected organisation did.
DIVD newsroom · MITRE CVE record, CVE-2026-102489 · Help Net Security · BleepingComputer
Questions, answered.
The two questions this record answers.
What was the entry point in the DIVD incident?
The published path starts at internet facing Zammad helpdesk, unauthenticated remote code execution, CVE-2026-102489.
What did it reach?
The last step in the published path is other internal services, data exfiltrated before network segmentation contained it.
Other incidents.
Same database, different path shape.
See what your agents can reach. Before someone else does.
Book a demo and we walk through the access paths in an environment like yours.