CVE-2026-34724

Zammad versions prior to 7.0.1 contain a server-side template injection vulnerability in the AI Agent feature that enables remote code execution when attackers can control or influence type_enrichment_data configuration settings. This vulnerability is typically accessible only to high-privilege administrative users, limiting the scope of potential attackers. The flaw was patched in version 7.0.1. The vulnerability carries a CVSS score of 7.2 (HIGH) with a network-based attack vector and low complexity, meaning exploitation requires no user interaction and can occur remotely. The attack requires high-level privileges (PR:H) but would result in complete compromise of system confidentiality, integrity, and availability if successfully exploited. The FAUCET risk score of 46.0 indicates moderate concern, though the EPSS score of 0.0006 suggests minimal observed exploitation activity in the wild. There is currently no evidence of active exploitation in the KEV catalog or broader threat intelligence, with the vulnerability remaining inactive on hot lists. No known public exploit code has been reported, and community attention appears limited. Organizations running Zammad should prioritize patching to version 7.0.1 and restrict administrative access to configuration settings as an interim mitigation.