Zammad closes a code execution fault in its AI Agent with one letter
The fault needs an administrator account, and the repair changed one function from "sub" to "gsub" to replace each one.
On 4 August 2026, Zammad, an open source helpdesk, released version 7.1.2 with 18 security repairs. The first closes CVE-2026-84462, a fault in the setup fields of its AI Agent part. An administrator could put in crafted text, go around a filter and operate commands on the server. GitHub rates it High, 8.6 of 10. All self hosted versions with 7.1.1 have it.
How it works
The filter changed the template opener “<%” to “<%%” to show it as text. It used the Ruby function “sub”, which changes only the first one. A second opener put directly after the first stayed active. The repair uses “gsub”, which changes each one.
The numbers
The advisory gives a severity score of 8.6. A group gives a 0.28% risk of use in attacks in the next 30 days. The advisory gives no proof of concept. No report of use in attacks exists.
What is not known
The advisory does not tell which field holds the template. The US National Vulnerability Database added its record on 25 September 2026, seven weeks after. The record has no identifier and no analysis of its own.
Insight: The weak point is the code around the AI, not the model
The Zammad fault is a text filter that stopped after one match. Reports of this month show the same pattern: changed names of variables made coding agents write dangerous code, and text in a repository made agents propose a wide rule. This looks like a change in the game. Attackers do not must defeat the model, only the plain code around it. Examine those parts first.
Sources
Posted
