DIVD breach traced to chained Zammad zero-days

Thu, 01 Oct 2026 17:21:52 +0000

Engineer — Plan: If you self-host Zammad, identify available patches for these two chained zero-days and schedule an emergency upgrade; no KEV listing or public PoC is confirmed yet, but exploitation was demonstrated in a real breach.
SOC/IR — Learn: The breach illustrates how chained zero-days in support tooling can pivot to broader network access, but the summary provides no IOCs or ATT&CK-mappable TTPs to act on today.
Leader — Plan: Audit whether Zammad is in your internal or vendor tooling stack; if so, request patch confirmation from the responsible team before month end given confirmed real-world exploitation.

Zammad on CuraSec