CVE-2026-34724: Zammad

High severity, CVSS 7.2. EPSS: 0.5% chance of exploitation in the next 30 days.

Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.1, a server-side template injection vulnerability which leads to RCE via AI Agent exists. Impact is limited to environments where an attacker can control or influence type_enrichment_data (typically high-privilege administrative configuration). This vulnerability is fixed in 7.0.1.

Affected products

• Zammad Zammad: version 7.0.0 only

Published 2026-04-08. Last modified 2026-07-24.