Skip to content
Threat Feed
Subscribe
high advisory

Zammad: Server-Side Template Injection remote code execution (CVE-2026-34724)

An authenticated administrator can exploit a Server-Side Template Injection (SSTI) vulnerability in the Zammad AI Agent feature to achieve remote code execution via the type_enrichment_data configuration.

CVE search metadata

CVE search record: CVE-2026-34724. Severity: high. CVSS: 7.2. EPSS: 0.31%. KEV: no. Product: Zammad (< 7.0.1). Brief: Zammad: Server-Side Template Injection remote code execution (CVE-2026-34724). Brief link: https://feed.craftedsignal.io/briefs/2026-10-zammad-ssti/

Triage facts

Revision 1
Applicability
Zammad (< 7.0.1)
Evidence
Unknown
Severity
High
Action
Immediate escalation
Sources
3 public sources
Freshness
Revision 1Oct 30, 18:01 UTC
Detection
1 rule
Vulnerabilities
1 CVE
Source quality
B2Likely

CVE-2026-34724 is a Server-Side Template Injection (SSTI) vulnerability identified in the Zammad helpdesk software's AI Agent feature. The vulnerability allows an authenticated administrator to inject arbitrary templates into the 'type_enrichment_data' configuration, which are subsequently rendered, leading to full Remote Code Execution (RCE) on the server. The vulnerability is confirmed in Zammad version 7.0.0 and is remediated in version 7.0.1.

Impact

Successful exploitation allows an authenticated attacker with administrative privileges to execute arbitrary commands on the underlying server as the process user (typically 'zammad' or 'www-data').

Recommendation

  • Upgrade Zammad installations to version 7.0.1 or 6.5.4 immediately.
  • If patching is not feasible, disable the AI Agent feature in the Zammad configuration.
  • Review administrative access controls and restrict access to the 'type_enrichment_data' configuration to highly trusted personnel only.
  • Monitor Zammad system logs for unauthorized changes to administrative configuration parameters, specifically 'type_enrichment_data'.

Immediate actions

Patch Zammad instances to version 7.0.1 or 6.5.4.

IT Operations 24h

Threat Hunt

Identify administrative accounts accessing the AI Agent configuration.

T1190 high high confidence hunt now

Data: Zammad audit logs

Mitigations

Disable AI Agent feature if patching is delayed.

immediate IT Operations

CVE-2026-34724

Detection coverage 1

Detect Zammad type_enrichment_data Modification

medium

Detects administrative updates to the AI Agent type_enrichment_data configuration, which is the vector for CVE-2026-34724.

sigma tactics: persistence techniques: T1190 sources: webserver

Detection queries are available on the platform. Get full rules →