# Zammad vulnerabilities Source: https://junglewise.ai/threats/technologies/zammad Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 12 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/technologies/zammad.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 44 vulnerabilities in Zammad: 0 in the last 7 days and 33 in the last 90 days, 2 of them critical and 2 exploited in the wild. The most recent, CVE-2026-102345, was published on 4 November 2026. 1 vulnerability in the last four weeks, down 97% on the four before (32). 0 critical against 2, 0 exploited in the wild against 2. ## Counts - Last 7 days: 0 - Last 30 days: 1 - Last 90 days: 33 - All time: 44 (2 critical, 2 exploited in the wild) ## About Zammad Zammad is an open-source helpdesk and customer support platform with a web-based interface. ## Latest Zammad vulnerabilities - [CVE-2026-102345: Zammad stored cross-site scripting in ticket article rendering](https://junglewise.ai/threats/cve-2026-102345-zammad-is-a-web-based-open-source-helpdesk-customer-support) (info, published 4 Nov 2026) - [CVE-2026-102490: Zammad privilege escalation to root](https://junglewise.ai/threats/cve-2026-102490-all-versions-of-zammad-including-the-latest-alpha-enable-the) (critical, exploited in the wild, published 30 Sep 2026) - [CVE-2026-102489: Zammad session hijack leading to remote code execution](https://junglewise.ai/threats/cve-2026-102489-zammad-versions-6-3-0-to-6-5-4-are-vulnerable-a-session-hijack) (critical, exploited in the wild, published 30 Sep 2026) - [CVE-2026-84465: Zammad S/MIME signature verification bypass allows sender impersonation](https://junglewise.ai/threats/cve-2026-84465-zammad-is-a-web-based-open-source-helpdesk-customer-support) (info, published 25 Sep 2026) - [CVE-2026-84464: Zammad unauthorized data access in External Data Source](https://junglewise.ai/threats/cve-2026-84464-zammad-is-a-web-based-open-source-helpdesk-customer-support) (info, published 25 Sep 2026) - [CVE-2026-84463: Zammad HTML injection in Knowledge Base video widget](https://junglewise.ai/threats/cve-2026-84463-zammad-is-a-web-based-open-source-helpdesk-customer-support) (info, published 25 Sep 2026) - [CVE-2026-84461: Zammad missing rate limiting in two-factor login](https://junglewise.ai/threats/cve-2026-84461-zammad-is-a-web-based-open-source-helpdesk-customer-support) (info, published 25 Sep 2026) - [CVE-2026-84460: Zammad information disclosure via tag enumeration](https://junglewise.ai/threats/cve-2026-84460-zammad-is-a-web-based-open-source-helpdesk-customer-support) (info, published 25 Sep 2026) - [CVE-2026-84458: Zammad account takeover via unverified email matching in SSO auto-link](https://junglewise.ai/threats/cve-2026-84458-zammad-is-a-web-based-open-source-helpdesk-customer-support) (info, published 25 Sep 2026) - [CVE-2026-63216: Zammad stored XSS in option labels configuration dialog](https://junglewise.ai/threats/cve-2026-63216-zammad-is-a-web-based-open-source-helpdesk-customer-support) (info, published 25 Sep 2026) - [CVE-2026-63208: Zammad OAuth token exposure in Microsoft Graph error logs](https://junglewise.ai/threats/cve-2026-63208-zammad-is-a-web-based-open-source-helpdesk-customer-support) (info, published 25 Sep 2026) - [CVE-2026-63207: Zammad sensitive information exposure in integration API](https://junglewise.ai/threats/cve-2026-63207-zammad-is-a-web-based-open-source-helpdesk-customer-support) (info, published 25 Sep 2026) - [CVE-2026-63206: Zammad HTML sanitizer bypass via shortened URL scheme](https://junglewise.ai/threats/cve-2026-63206-zammad-is-a-web-based-open-source-helpdesk-customer-support) (info, published 25 Sep 2026) - [CVE-2026-63205: Zammad authorization bypass via email signature attachments](https://junglewise.ai/threats/cve-2026-63205-zammad-is-a-web-based-open-source-helpdesk-customer-support) (info, published 25 Sep 2026) - [CVE-2026-63204: Zammad information disclosure in AI ticket summarize endpoint](https://junglewise.ai/threats/cve-2026-63204-zammad-is-a-web-based-open-source-helpdesk-customer-support) (info, published 25 Sep 2026) - [CVE-2026-63006: Zammad HTML sanitizer path traversal in image URLs](https://junglewise.ai/threats/cve-2026-63006-zammad-is-a-web-based-open-source-helpdesk-customer-support) (info, published 25 Sep 2026) - [CVE-2026-61855: Zammad invalid PGP signature verification on inbound email](https://junglewise.ai/threats/cve-2026-61855-zammad-is-a-web-based-open-source-helpdesk-customer-support) (info, published 25 Sep 2026) - [CVE-2026-84462: Zammad AI Agent template sanitizer bypass in ERB configuration](https://junglewise.ai/threats/cve-2026-84462-zammad-is-a-web-based-open-source-helpdesk-customer-support) (info, published 25 Sep 2026) - [CVE-2026-65828: Zammad attachment upload deletion bypass in legacy endpoint](https://junglewise.ai/threats/cve-2026-65828-zammad-is-a-web-based-open-source-helpdesk-customer-support) (info, published 25 Sep 2026) - [CVE-2026-61525: Zammad path traversal in session management](https://junglewise.ai/threats/cve-2026-61525-zammad-is-a-web-based-open-source-helpdesk-customer-support) (info, published 25 Sep 2026) - [CVE-2026-56735: Zammad HTML sanitizer bypass via srcset attribute](https://junglewise.ai/threats/cve-2026-56735-zammad-is-a-web-based-open-source-helpdesk-customer-support) (info, published 25 Sep 2026) - [CVE-2026-56734: Zammad SSRF in federated authentication profile image fetch](https://junglewise.ai/threats/cve-2026-56734-zammad-is-a-web-based-open-source-helpdesk-customer-support) (info, published 25 Sep 2026) - [CVE-2026-56733: Zammad authorization bypass in token-based access control](https://junglewise.ai/threats/cve-2026-56733-zammad-is-a-web-based-open-source-helpdesk-customer-support) (info, published 25 Sep 2026) - [CVE-2026-56732: Zammad HTML sanitization session termination](https://junglewise.ai/threats/cve-2026-56732-zammad-is-a-web-based-open-source-helpdesk-customer-support) (info, published 25 Sep 2026) - [CVE-2026-56731: Zammad cross-site scripting in ticket creation](https://junglewise.ai/threats/cve-2026-56731-zammad-is-a-web-based-open-source-helpdesk-customer-support) (info, published 25 Sep 2026) ## Most severe Zammad vulnerabilities - [CVE-2026-102489: Zammad session hijack leading to remote code execution](https://junglewise.ai/threats/cve-2026-102489-zammad-versions-6-3-0-to-6-5-4-are-vulnerable-a-session-hijack) (critical, exploited in the wild, published 30 Sep 2026) - [CVE-2026-102490: Zammad privilege escalation to root](https://junglewise.ai/threats/cve-2026-102490-all-versions-of-zammad-including-the-latest-alpha-enable-the) (critical, exploited in the wild, published 30 Sep 2026) - [CVE-2026-34723: Zammad improper access control in getting_started_controller](https://junglewise.ai/threats/cve-2026-34723-zammad-improper-access-control-in-getting-started-controller) (high, CVSS 7.5, published 8 Apr 2026) - [CVE-2026-34724: Zammad server-side template injection in AI Agent](https://junglewise.ai/threats/cve-2026-34724-zammad-server-side-template-injection-in-ai-agent) (high, CVSS 7.2, published 8 Apr 2026) - [CVE-2026-34721: Zammad CSRF in OAuth callback endpoints](https://junglewise.ai/threats/cve-2026-34721-zammad-csrf-in-oauth-callback-endpoints) (medium, CVSS 6.5, published 8 Apr 2026) - [CVE-2026-34718: Zammad HTML sanitizer XSS in ticket articles](https://junglewise.ai/threats/cve-2026-34718-zammad-html-sanitizer-xss-in-ticket-articles) (medium, CVSS 6.1, published 8 Apr 2026) - [CVE-2026-34248: Zammad improper access control in ticket detail view](https://junglewise.ai/threats/cve-2026-34248-zammad-improper-access-control-in-ticket-detail-view) (medium, CVSS 5.7, published 8 Apr 2026) - [CVE-2026-34719: Zammad SSRF in webhook model](https://junglewise.ai/threats/cve-2026-34719-zammad-ssrf-in-webhook-model) (medium, CVSS 4.3, published 8 Apr 2026) - [CVE-2026-34837: Zammad missing authorization in AI assistance text tools](https://junglewise.ai/threats/cve-2026-34837-zammad-missing-authorization-in-ai-assistance-text-tools) (medium, CVSS 4.3, published 8 Apr 2026) - [CVE-2026-34782: Zammad missing authorization in AI assistance text tools](https://junglewise.ai/threats/cve-2026-34782-zammad-missing-authorization-in-ai-assistance-text-tools) (medium, CVSS 4.3, published 8 Apr 2026) ## Vulnerabilities per week 1 vulnerability in the last four weeks, down 97% on the four before (32). 0 critical against 2, 0 exploited in the wild against 2. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 0 | 0 | 0 | | 21 Sep 2026 | 30 | 0 | 0 | | 28 Sep 2026 | 2 | 2 | 2 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 0 | 0 | 0 | | 19 Oct 2026 | 0 | 0 | 0 | | 26 Oct 2026 | 0 | 0 | 0 | | 2 Nov 2026 | 1 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "Zammad vulnerabilities", https://junglewise.ai/threats/technologies/zammad, 12 November 2026.