That is what happened at the Dutch Institute for Vulnerability Disclosure (DIVD) this month. And it was not the only chain in the news.
The week's biggest security stories share one pattern: attackers are combining vulnerabilities faster than most teams can score them one at a time.
What happened this week
DIVD confirmed that an AI-driven attacker chained two flaws in the Zammad helpdesk platform, moving from a hijacked session to root in seconds, and that data was exfiltrated. CISA has since added both flaws to its Known Exploited Vulnerabilities (KEV) catalog. DIVD advises Zammad users to upgrade to version 7 or take instances offline.
Rapid7 told Cybersecurity Dive that threat actors are pairing CVE-2026-88779 with CVE-2026-88771, a remote code execution flaw in Citrix NetScaler. CVE-2026-88779 is the third exploited NetScaler flaw in recent weeks, and researchers say CVE-2026-88771 and CVE-2026-88772 have been exploited since late August. CISA released Sigma detection rules on October 2.
CVE-2026-76504, a Cisco Catalyst SD-WAN Manager authentication bypass rated CVSS 9.8, lets an unauthenticated remote attacker gain admin-level access. watchTowr noted that eight 2026 Cisco SD-WAN CVEs are now on KEV. CISA also added CVE-2026-104286, a Fortinet FortiMail path traversal flaw, based on evidence of active exploitation.
Why a single CVE score can't see a chain
Severity scores were built to describe one vulnerability in isolation. They answer a useful question: how bad is this bug?
Attackers ask a different one: what does this bug let me reach when I combine it with the next one?
A session flaw that looks moderate on its own can become the first step to root when paired with a privilege flaw. A denial of service bug can become part of a remote code execution path.
This is why attack path validation matters more each month.
Not "how severe is each finding?" but "can an attacker get from here to something that matters, and does the path still work after we fix it?"
BOD 26-04 is shortening the clock
CISA's Binding Operational Directive 26-04 replaces CVSS-driven deadlines with risk-based remediation windows. It uses a four-factor model that produces one of four outcomes.
The directive applies to federal civilian agencies, but CISA encourages all organizations to adopt risk-based prioritization.
A 3-day window leaves no room to debate which findings matter. Teams need to know in advance which exposures sit on a real path, so the shortest windows go to the fixes that actually break a chain.
Get this breakdown every week.
The Hayrok Brief covers exploited vulnerabilities, AI security and regulation for security leaders, with what to validate each week.
AI tooling is now part of the attack surface
The same speed applies to the tools teams are adopting.
AI agents, and the frameworks around them, can now be both the attacker and the path. Testing what an agent can reach, and whether it can be steered outside its scope, belongs in the same program as testing your edge devices.
Three things to validate this week
0 of 3 validatedConfirm whether NetScaler (SAML with Gateway or AAA configurations), Cisco SD-WAN Manager, FortiMail and Zammad are present and patched. Then test whether the chained paths reported this week, such as session hijack to root, are actually blocked. Use the CISA Sigma rules to check for compromise that happened before the patch.
Inventory MCP SDK versions and self-hosted GitLab AI Gateways and confirm fixed versions are deployed. Then test whether an agent could be steered to an untrusted server or run commands outside its intended scope.
Review what vendors, professional services firms and customer messaging platforms can reach, including push notifications and token access. Verify that you can detect and contain misuse in hours, not days.
How Hayrok approaches chained exposure
Hayrok is built for this problem. As a Governed Adversarial Exposure Validation platform, it tests the paths an attacker would take through your environment, only within the scope your team defines and only with your approval. Every step is recorded as evidence, and when a fix ships, Hayrok tests the same path again so your team can prove a fix actually worked.
Test your own paths in 90 days.
The program runs against a scope your team defines, with your approval for every test and evidence for every result.
Frequently asked questions
What is exploit chaining?
Exploit chaining is when an attacker combines two or more vulnerabilities so that each one enables the next, reaching access or impact that no single flaw would allow on its own.
Why do CVSS scores miss chained risk?
CVSS scores rate each vulnerability on its own. They do not measure what an attacker can reach when that vulnerability is combined with others in a specific environment.
What happened in the DIVD breach?
An AI-driven attacker chained two Zammad zero-days, CVE-2026-102489 and CVE-2026-102490, to move from a hijacked session to root in seconds. DIVD confirmed data was exfiltrated.
What should Zammad users do?
DIVD advises upgrading to version 7 or taking instances offline. Both CVEs are now on CISA's KEV catalog.
What is BOD 26-04?
A CISA Binding Operational Directive that replaces CVSS-driven deadlines with risk-based remediation windows of 3, 14 or 60 days, or deferral to the next upgrade.
Does BOD 26-04 apply to private companies?
It applies to federal civilian agencies, but CISA encourages all organizations to adopt risk-based prioritization.
How do you validate an attack path?
By safely testing whether an attacker could move from a realistic starting point through a sequence of weaknesses to a valuable asset in your environment, recording the evidence, and testing again after remediation.
Are AI agents part of the attack surface?
Yes. This week's MCP Python SDK and GitLab AI Gateway issues show that AI tooling can be steered or escaped, so what an agent can reach should be tested like any other path.
At Hayrok Labs we question everything and Validate what matters.
SOURCES · Sysdig, Help Net Security, CISA, Cybersecurity Dive, The Hacker News, Cloud Security Alliance, Cycode.