Is CVE-2026-84462 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-84462 being exploited in the wild.

How severe is CVE-2026-84462?

Informational severity, published 25 September 2026.

Is there a fix for CVE-2026-84462?

A patch was published on 2026-09-25: Version 7.1.2 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-84462 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-84462?

Check whether you run Zammad at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-84462: Zammad AI Agent template sanitizer bypass in ERB configuration

CVE-2026-84462 · Severity: info · Published 2026-09-25

Zammad is an open source helpdesk and customer support system. A flaw in the AI Agent configuration security filter allows an administrator to bypass protections by crafting malicious text in AI Agent fields, leading to arbitrary command execution on the server. An attacker with admin privileges can read, modify, or destroy all data stored in the system without needing other users to interact with it.

Technologies: Zammad. Vendors: Zammad.

Quick answers

Is CVE-2026-84462 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-84462 being exploited in the wild.
How severe is CVE-2026-84462?: Informational severity, published 25 September 2026.
Which products and versions are affected?: Zammad prior to 7.1.2.
Is there a fix for CVE-2026-84462?: A patch was published on 2026-09-25: Version 7.1.2 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-84462 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-84462?: Check whether you run Zammad at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The ERB sanitizer protecting Zammad's AI Agent template configuration can be bypassed through specially crafted input, allowing an authenticated administrator to inject and execute arbitrary Ruby/ERB code. The vulnerability requires administrator privilege to create or edit AI Agents, but no user interaction is needed for exploitation—malicious code executes automatically when the AI Agent processes a ticket. The issue was fixed by improving the ERB sanitizer in version 7.1.2.

Affected products

Zammad Zammad prior to 7.1.2

Timeline

2026-08-04: disclosed
2026-09-25: patched: Version 7.1.2 released

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.