CVSS 4.0
8.7 highCVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:HCVE-2026-34724
High (8.7) in zammad zammad. EPSS 0.3% chance of exploitation in the next 30 days.
Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.1, a server-side template injection vulnerability which leads to RCE via AI Agent exists. Impact is limited to environments where an attacker can control or influence type_enrichment_data (typically high-privilege administrative configuration). This vulnerability is fixed in 7.0.1.
Severity
CVSS 3.1
7.2 highCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H- EPSS
- 0.3% chance of exploitation in the next 30 days; higher than 24% of CVEs (scores of 2026-10-31)
- CWEs
- CWE-94, CWE-1336
- Published
- Modified
- Record from
- the NVD, synced
Affected
- zammad:zammad