Alje Woltjer

**Name of the Vulnerable Software and Affected Versions** Zammad versions 6.3.0 through 6.5.4 **Description** A session hijack issue allows for remote code execution as the zammad user. This flaw was utilized in a real-world incident involving the DIVD Dutch Institute, where agentic AI automation was used to exfiltrate data. **Recommendations** Update Zammad to version 7.0.0 or later. Take the system offline to prevent exploitation.

**Name of the Vulnerable Software and Affected Versions** Zammad (affected versions not specified) **Description** Improper privilege management allows a local `zammad` user to escalate privileges to root. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.