# CVE-2026-84465: Zammad S/MIME signature verification bypass allows sender impersonation

Source: https://junglewise.ai/threats/cve-2026-84465-zammad-is-a-web-based-open-source-helpdesk-customer-support  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-25. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-84465 · Severity: info · Published 2026-09-25

Zammad is a web-based helpdesk and customer support system that handles incoming emails, including digitally signed S/MIME messages. Prior to version 7.1.2, the system fails to properly verify that signing certificates are genuinely trusted; an attacker can forge a certificate bearing a legitimate sender's name and use it to send spoofed emails that Zammad will display as validly signed, potentially deceiving users about the message's authenticity and enabling social engineering attacks.

Technologies: [Zammad](https://junglewise.ai/threats/technologies/zammad). Vendors: [Zammad](https://junglewise.ai/threats/vendors/zammad).

## Quick answers

**Is CVE-2026-84465 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-84465 being exploited in the wild.

**How severe is CVE-2026-84465?** Informational severity, published 25 September 2026.

**Which products and versions are affected?** Zammad 7.1.1 and earlier.

**Is there a fix for CVE-2026-84465?** A patch was published on 2026-08-03: Fix committed; version 7.1.2 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-84465 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-84465?** Check whether you run Zammad at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability exists in S/MIME signature verification logic that only checks whether a certificate with a matching name exists in the system's certificate store, without validating that the certificate is genuinely trusted or part of a valid trust chain. An attacker with the ability to send email to the system can craft an S/MIME message signed with a self-created certificate bearing a trusted sender's name; Zammad will validate and display the signature as legitimate. This is a cryptographic validation flaw (CWE-295, improper certificate validation) that requires no authentication or user interaction beyond the system receiving an email.

## Affected products

- Zammad Zammad 7.1.1 and earlier

## Timeline

- 2026-08-04: disclosed
- 2026-08-03: patched: Fix committed; version 7.1.2 released

## References

- [https://github.com/zammad/zammad/commit/9a07d0b8214ac4e8e10c23fce71d613bd0625524](https://github.com/zammad/zammad/commit/9a07d0b8214ac4e8e10c23fce71d613bd0625524)
- [https://github.com/zammad/zammad/security/advisories/GHSA-m9ff-hjr3-93h4](https://github.com/zammad/zammad/security/advisories/GHSA-m9ff-hjr3-93h4)

## Related threats

- [Zammad stored cross-site scripting in ticket article rendering](https://junglewise.ai/threats/cve-2026-102345-zammad-is-a-web-based-open-source-helpdesk-customer-support)
- [Zammad privilege escalation to root](https://junglewise.ai/threats/cve-2026-102490-all-versions-of-zammad-including-the-latest-alpha-enable-the)
- [Zammad session hijack leading to remote code execution](https://junglewise.ai/threats/cve-2026-102489-zammad-versions-6-3-0-to-6-5-4-are-vulnerable-a-session-hijack)
- [Zammad unauthorized data access in External Data Source](https://junglewise.ai/threats/cve-2026-84464-zammad-is-a-web-based-open-source-helpdesk-customer-support)
- [Zammad HTML injection in Knowledge Base video widget](https://junglewise.ai/threats/cve-2026-84463-zammad-is-a-web-based-open-source-helpdesk-customer-support)