The two vulnerabilities were chained together to gain access, rather than relying on a single isolated flaw. DIVD has not published specific CVE IDs for either issue in the information available so far, so defenders should track DIVD's own advisories and Zammad's release notes for identifiers and patches rather than assuming a public CVE number exists.

Key points to be aware of:

• The affected product is Zammad, an open-source helpdesk and ticketing platform.
• Two separate zero-day vulnerabilities were required to complete the exploit chain.
• The breach targeted DIVD's own network infrastructure.
• The attack was described as AI-driven, indicating significant automation in the exploitation process.
• No specific CVE IDs or advisory numbers have been confirmed in the available reporting.

Recommended actions for organizations running Zammad:

• Treat any internet-facing Zammad instance as potentially at risk until vendor guidance is published.
• Monitor Zammad's official channels and DIVD's disclosures for patch information and technical details.
• Review ticketing system logs for unusual access patterns, unexpected administrative actions, or anomalous API activity.
• Restrict exposure of ticketing systems where possible, and enforce strong authentication and network-level controls.
• Apply vendor patches promptly once they become available.

This case is a reminder that even organizations focused on vulnerability disclosure can be targeted, and that chained zero-days combined with automated attack tooling can defeat assumptions about a single point of failure.

Source: Publication Name

Does your organization run Zammad externally, and if so, how are you handling exposure until patches land?