What happened
GitHub advisory (25 Sept 2026): Zammad's AI Agent configuration is protected by a security filter that can be bypassed with specially crafted field text, letting an admin-configured agent inject command execution that fires automatically when the agent processes tickets (CVSS 8.6).
Why it matters
AI-agent configuration is a trusted code path; bypassing its input filter means the 'agent' becomes a persistent server-RCE primitive in helpdesk infrastructure that handles sensitive customer/ticket context.
Attack vector
An administrator who can create/edit Zammad AI Agents bypasses the security filter protecting AI Agent configuration by entering specially crafted text into an AI Agent field; the malicious code runs automatically the next time the affected AI Agent processes a ticket, achieving arbitrary command execution on the Zammad host.
Affected systems
Zammad helpdesk before 7.1.2
Mitigation
Upgrade Zammad to >= 7.1.2 (fix commit e3b0c8df91ad2108c8305be23e8fe6f73fb9718d).