zammad has 33 CVEs on record between 2024 and 2026. Disclosure cadence is accelerating: 32 in the last 90 days against 0 in the 90 before. The busiest recent month was September 2026 with 32. The median CVSS is 6.3 (medium), with 3 rated critical. 6% have been exploited in the wild, in line with the corpus average. The dominant weakness classes are CWE-639 (7) and CWE-862 (6).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 6% vs 1% corpus
- Median CVSS
- 6.3
- Publish → KEV
- —(2)
- Last 90 days
- 32 prev 0
Worst active — by depth score
CVE-2026-102489Critical· 9.8Zammad versions 6.3.0 to 6.5.4 are vulnerable a session hijack vulnerability that leads to remote code execution as the zammad user79CVE-2026-102490High· 7.8Zammad packages built with packager.io (DEB and RPM) could have allowed a local attacker who already had file system write privileges as the unprivileged zammad service account to escalate to full root privileges on the host68CVE-2024-33668Critical· 9.1An issue was discovered in Zammad before 6.3.062CVE-2026-84458Critical· 9.1Zammad is a web based open source helpdesk/customer support system50CVE-2026-61525High· 8.8Zammad is a web based open source helpdesk/customer support system48
zammad vulnerabilities
CVEs affecting zammad, newest first. Open any entry for full detail, references, and exploit status.
33 CVEsRSS
CVE-2026-56723High· 7.1Zammad is a web based open source helpdesk/customer support system
Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.2, a customer who can view a ticket cannot see internal ticket articles through the article listing API. However, the same customer can directly request an …
CVE-2026-56729Low· 2.1Zammad is a web based open source helpdesk/customer support system
Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.2, when multiple KB categories have different editor roles assigned, a user with knowledge_base.editor in one category can see answer titles and updated_at …
CVE-2024-33668Critical· 9.1PoCAn issue was discovered in Zammad before 6.3.0
An issue was discovered in Zammad before 6.3.0. The Zammad Upload Cache uses insecure, partially guessable FormIDs to identify content. An attacker could try to brute force them to upload malicious content to article drafts they have no …