// UNCLASSIFIED // CLEARED FOR PUBLIC RELEASE //
FILE BRC-wedgDTG 0600Z
ColdRecon / Breach Radar / Zammad
Breach Record

Zammad

DISCLOSED 2026-10-02 · UNPATCHED CVE

The Dutch Institute for Vulnerability Disclosure (DIVD) was targeted in an attack that exploited two zero-day vulnerabilities in the Zammad helpdesk software. The attacker used an agentic AI system to discover and exploit the flaws, compromising DIVD's systems. This incident highlights the emerging threat of AI-driven autonomous attacks against security organizations.

The record

What we know

Disclosed
2026-10-02
Attack vector
Unpatched Cve
Sources

Cited reporting

↗ infosecurity-magazine.com (2026-10-02) ↗ www.infosecurity-magazine.com (2026-10-02)
Similar vector · recent

Other unpatched cve breaches on file

Pentagon · 2026-10-02 FBI · 2026-09-26 Samsung · 2026-09-25 Japan's Digital Agency · 2026-09-18 Gyazo · 2026-09-18 Japan's Digital Agency · 2026-09-17 U.S. government agencies · 2026-09-16 Japan's shared government network · 2026-09-15

This page is the permanent ColdRecon entry for the Zammad disclosure. It updates if new public reporting emerges. All tracked breaches →

Zammad just lived through this. Your next prospect doesn't have to.

ColdRecon turns every disclosed breach into a daily intelligence brief from the seller's seat — normalized to the factors that move a deal, written in the Handler's voice. Request clearance and the first lands tomorrow at 0600.

Request Clearance →