Dutch Vulnerability Hub Compromised Through Dual Zammad Zero‑Day Exploits in AI‑Driven Attack

The Dutch Institute for Vulnerability Disclosure confirmed that its internal systems were infiltrated after attackers leveraged two previously unknown vulnerabilities in the open‑source ticketing platform Zammad. The chain of exploits, described as zero‑day flaws, enabled the perpetrators to execute arbitrary code remotely and ultimately obtain root‑level access on the institute's servers.

The institute, which serves as a central repository for security researchers to report software weaknesses, plays a critical role in coordinating disclosures and mitigating risks across the Netherlands' digital infrastructure. A breach of its own environment raises concerns about the safeguarding of sensitive vulnerability data and the trust placed in such coordination bodies.

Zammad, widely adopted for managing support requests and security reports, had not previously been associated with publicly disclosed critical flaws. In this incident, attackers identified two distinct weaknesses—one allowing unauthenticated command injection and another bypassing authentication controls. By chaining the bugs together, they were able to run malicious payloads without detection.

What sets the attack apart is its reliance on artificial‑intelligence tools to automate the discovery and exploitation process. Security analysts noted that the use of AI models can accelerate the identification of complex vulnerability chains, reducing the time required to develop functional exploits for zero‑day conditions.

With root privileges secured, the intruders could theoretically access any data stored on the institute's network, including unpublished vulnerability reports and contact information for security researchers. While the full extent of the data exposure has not been disclosed, the incident underscores the potential cascading impact when a vulnerability‑coordination hub is compromised.

In response, the institute has initiated a forensic investigation, engaged with Zammad's development team to issue patches, and informed relevant national cybersecurity authorities. The breach highlights a growing challenge for organizations that rely on third‑party open‑source tools: the need for continuous monitoring and rapid patching, especially as AI‑enhanced threat actors become more prevalent. Observers suggest that the episode may prompt broader industry discussions on securing the supply chain of security‑critical software and reinforcing defenses against AI‑facilitated attacks.