Skip to content
OpenAdvisories

Vendor

zammad

49 known vulnerabilities.

Products

zammad 49
All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Critical 9.4
    CVE-2026-102489 Exploited Public exploit EPSS 50%

    Undisclosed RCE in Zammad v6.3 and higher

    Zammad versions 6.3.0 to 6.5.4 are vulnerable a session hijack vulnerability that leads to remote code execution as the zammad user. The bug is also present in version 7.0.0 to version 7.1.2, but not exploitable due to changes in the underlying framework.

    zammad zammad
    KEV Oct 2, 2026
  • High 8.7
    CVE-2026-34724 Public exploit

    Zammad has a server-side template injection leading to RCE via AI Agent

    Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.1, a server-side template injection vulnerability which leads to RCE via AI Agent exists. Impact is limited to environments where an attacker can control or influence type_enrich…

    zammad zammad