CVE-2026-84462

Name of the Vulnerable Software and Affected Versions Zammad versions prior to 7.1.2

Description A security filter protecting the AI Agent configuration can be bypassed by entering specially crafted text into an AI Agent field. An administrator with permissions to create or edit AI Agents can exploit this to execute arbitrary commands on the host server, which may lead to the unauthorized reading, modification, or destruction of all stored data. The malicious code executes automatically when the affected AI Agent processes a ticket, requiring no interaction from other users.

Recommendations Update to version 7.1.2.