Plan
archived
DIVD breach traced to chained Zammad zero-days
- Engineer — Plan: If you self-host Zammad, identify available patches for these two chained zero-days and schedule an emergency upgrade; no KEV listing or public PoC is confirmed yet, but exploitation was demonstrated in a real breach.
- SOC/IR — Learn: The breach illustrates how chained zero-days in support tooling can pivot to broader network access, but the summary provides no IOCs or ATT&CK-mappable TTPs to act on today.
- Leader — Plan: Audit whether Zammad is in your internal or vendor tooling stack; if so, request patch confirmation from the responsible team before month end given confirmed real-world exploitation.
This entry was curated and judged by AI (Claude) with automated enrichment
(CISA KEV / EPSS / public PoC). Verify against the original source before
acting. Found a bad verdict?
Report it —
confirmed errors go to the corrections log.