Command Injection Vulnerability in Zammad Helpdesk System

CVE-2026-84462

What is CVE-2026-84462?

Zammad, an open-source helpdesk and customer support system, is vulnerable to command injection attacks. Prior to version 7.1.2, its AI Agent configuration security filter can be bypassed by an administrator through manipulated input in specific fields. This flaw allows execution of arbitrary commands on the hosting server, leading to potential data compromise, including unauthorized access to, modification, or deletion of sensitive data. Importantly, this exploit does not require interaction from other users, as the malicious code executes automatically when the affected AI Agent processes a ticket. Version 7.1.2 addresses this vulnerability.

References