ZA
Product
zammad
On CISA KEVExploited in the wild
123
CVEs
2
On KEV
9.8
Max CVSS
2
New 30D
Severity mix
Critical 12High 32Medium 75Low 4
Watch
Add zammad to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-102489 In wildKEV | 9.8 | Sep 30 | Undisclosed RCE in Zammad v6.3 and higher Affected: 6.3.0 through 6.5.4 |
| CVE-2022-48021 | 9.8 | Feb 3 | A vulnerability in Zammad v5.3.0 allows attackers to execute arbitrary code or escalate privileges via a crafted message sent to the server Affected: 5.3.0 |
| CVE-2022-35490 | 9.8 | Aug 8 | Zammad 5.2.0 is vulnerable to privilege escalation Affected: 5.2.0; 5.2.0 |
| CVE-2021-42090 | 9.8 | Oct 7 | An issue was discovered in Zammad before 4.1.1 Affected: before 4.1.1 |
| CVE-2021-42094 | 9.8 | Oct 7 | An issue was discovered in Zammad before 4.1.1 Affected: before 4.1.1 |
| CVE-2020-26030 | 9.8 | Dec 28 | An issue was discovered in Zammad before 3.4.1 Affected: 1.0.0 before 3.4.1 |
| CVE-2017-6080 | 9.8 | Mar 13 | An issue was discovered in Zammad before 1.0.4, 1.1.x before 1.1.3, and 1.2.x before 1.2.1, caused by lack of a protection mechanism involving HTTP Access-Control headers Affected: through 1.0.3; 1.1.0; 1.1.1; 1.1.2; 1.2.0 |
| CVE-2017-5619 | 9.8 | Mar 13 | An issue was discovered in Zammad before 1.0.4, 1.1.x before 1.1.3, and 1.2.x before 1.2.1 Affected: through 1.0.3; 1.1.0; 1.1.1; 1.1.2; 1.2.0 |
| CVE-2026-84458 | 9.1 | Sep 25 | Zammad: Account takeover via unverified email matching during SSO auto-link Affected: < 7.1.2 |
| CVE-2024-33668 | 9.1 | Apr 26 | An issue was discovered in Zammad before 6.3.0 Affected: 6.2.0 before 6.3.0; 6.3.0 |
| CVE-2022-27332 | 9.1 | Apr 27 | An access control issue in Zammad v5.0.3 allows attackers to write entries to the CTI caller log without authentication Affected: before 5.1.0 |
| CVE-2021-42091 | 9.1 | Oct 7 | An issue was discovered in Zammad before 4.1.1 Affected: before 4.1.1 |
Showing 12