CVE-2026-84462 in Zammad
Summary
by MITRE • 09/25/2026
Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, a security filter that protects Zammad's AI Agent configuration can be bypassed by entering specially crafted text into one of an AI Agent's fields. An administrator with permission to create or edit AI Agents could exploit this to run arbitrary commands on the server that hosts Zammad, potentially reading, modifying, or destroying all data stored on that server. No interaction from other users is needed; the malicious code runs automatically the next time the affected AI Agent processes a ticket. This issue is fixed in version 7.1.2.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/25/2026
The vulnerability identified in Zammad prior to version 7.1.2 represents a critical server-side security flaw rooted in inadequate input validation within the artificial intelligence agent configuration module. As an open-source helpdesk and customer support platform, Zammad relies on complex integrations with external AI services to automate ticket processing and response generation. The specific weakness lies in the sanitization logic applied to fields used for configuring these AI agents. While a security filter was implemented to restrict potentially dangerous inputs, it contained logical gaps that allowed specially crafted text strings to bypass these protections. This failure in input validation enables an attacker with administrative privileges or sufficient permissions to create or edit AI agent configurations to inject malicious payloads directly into the system's execution context.
From a technical perspective, this flaw constitutes a classic case of Command Injection, categorized under CWE-78: Improper Neutralization of Special Elements used in an OS Command. The vulnerability arises because the application fails to adequately sanitize user-supplied data before passing it to underlying operating system commands or script interpreters. When an administrator inputs crafted text into one of the AI agent fields, this input is not properly escaped or validated against a strict allowlist of expected characters and structures. Consequently, when the Zammad backend processes these configurations, the malicious code is interpreted as executable instructions rather than literal data strings. This allows for the execution of arbitrary commands on the server hosting the Zammad instance with the privileges associated with the application's runtime user account.
The operational impact of this vulnerability is severe due to its potential for complete system compromise. An attacker who exploits this flaw can execute arbitrary commands, which typically grants them the ability to read sensitive data stored in databases or file systems, modify existing records to alter business logic or customer information, and potentially destroy critical infrastructure components. The attack vector does not require interaction from end-users or other stakeholders; it is a targeted action performed by an insider threat or an attacker who has gained administrative access through credential theft or privilege escalation. Furthermore, the malicious code executes automatically whenever the affected AI agent processes a ticket, meaning that even if the initial injection is subtle, its effects can be triggered repeatedly during normal operational workflows, increasing the likelihood of detection and impact over time.
This vulnerability aligns with several tactics in the MITRE ATT&CK framework, specifically Command and Scripting Interpreter (T1059) for the execution mechanism and potentially Data from Local System (T1005) if data exfiltration occurs. The lack of proper input validation also reflects weaknesses often associated with CWE-20: Improper Input Validation. Because Zammad is a web-based application, this vulnerability highlights the risks inherent in complex enterprise software where administrative interfaces may have broader system access than intended. The automatic execution upon ticket processing means that the persistence mechanism is tied to business logic rather than traditional file system modifications, making it difficult to detect through standard endpoint monitoring without deep inspection of application logs and configuration changes.
Mitigation strategies must focus on immediate patching and enhanced input validation practices. Organizations running Zammad versions prior to 7.1.2 should upgrade to version 7.1.2 or later immediately, as this release includes the necessary fixes to close the bypass in the security filter. In addition to upgrading, administrators should review access controls for AI agent configuration modules, ensuring that only trusted personnel have permission to create or edit these settings. Implementing strict allowlist-based input validation on all fields passed to system commands is essential to prevent similar command injection vulnerabilities in future updates. Regular auditing of administrative actions and monitoring for unusual process executions originating from the Zammad service account can also help detect exploitation attempts early, although prevention through patching remains the most effective defense against this specific flaw.