Platform
zammad
Component
zammad
Fixed in
7.0.1
CVE-2026-34724 describes a Remote Code Execution (RCE) vulnerability discovered in Zammad, a web-based helpdesk/customer support system. This flaw allows an attacker to potentially execute arbitrary code through server-side template injection, specifically when manipulating typeenrichmentdata within the AI Agent feature. The vulnerability affects Zammad versions 7.0.0 and prior to 7.0.1. A fix is available in version 7.0.1.
The impact of CVE-2026-34724 is significant due to its potential for Remote Code Execution. Successful exploitation would allow an attacker to gain control over the Zammad server, potentially leading to data breaches, system compromise, and disruption of helpdesk operations. The vulnerability is limited to environments where an attacker can control or influence the typeenrichmentdata, typically requiring administrative privileges. This means an attacker needs to have some level of access or influence over the Zammad configuration to exploit the vulnerability. A successful attack could allow an attacker to read sensitive customer data, modify support tickets, or even install malware on the server.
CVE-2026-34724 was publicly disclosed on 2026-04-08. There are currently no known public proof-of-concept exploits available. The vulnerability is not listed on the CISA KEV catalog at the time of this writing. Given the RCE nature of the vulnerability and the potential for impact, it is recommended to prioritize remediation.
Exploit Status
EPSS
0.06% (18% percentile)
CISA SSVC
The primary mitigation for CVE-2026-34724 is to immediately upgrade Zammad to version 7.0.1 or later. If upgrading is not immediately feasible, restrict access to the typeenrichmentdata configuration to trusted users only. Carefully review and validate any data being passed to the AI Agent feature. Consider implementing a Web Application Firewall (WAF) with rules to detect and block suspicious template injection attempts. Monitor Zammad logs for unusual activity or errors related to the AI Agent feature. After upgrading, confirm the fix by attempting to trigger the vulnerable template injection scenario and verifying that it is no longer exploitable.
Update Zammad to version 7.0.1 or later to mitigate the server-side template injection vulnerability via the AI Agent. Ensure you review and restrict access to the 'type_enrichment_data' configuration to prevent exploitation by high-privileged attackers.
Vulnerability analysis and critical alerts directly to your inbox.
CVE-2026-34724 is a Remote Code Execution vulnerability in Zammad helpdesk systems, allowing attackers to potentially execute code via server-side template injection in the AI Agent feature.
You are affected if you are running Zammad versions 7.0.0 or earlier. Upgrade to 7.0.1 to mitigate the risk.
Upgrade Zammad to version 7.0.1 or later. Restrict access to the typeenrichmentdata configuration if immediate upgrade is not possible.
There are currently no confirmed reports of active exploitation, but the RCE nature warrants prompt remediation.
Refer to the official Zammad security advisory for detailed information and updates: [https://docs.zammad.com/en/latest/security/advisories/](https://docs.zammad.com/en/latest/security/advisories/)
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.