Will Zammad zero-day exploits enable a second documented breach by end of 2026?

The Dutch Institute for Vulnerability Disclosure (DIVD) disclosed that its network breach exploited a chain of two zero-day vulnerabilities in the open-source Zammad ticketing system. This represents a credible, real-world exploitation pattern that may be replicated by other threat actors.

Resolution Criteria

Public disclosure by a credible source (DIVD, CISA, vendor advisory, or reputable security research publication) of a second organization breached via Zammad zero-day(s), with evidence linking the breach to exploitation of the same or similar Zammad vulnerabilities.