CVE-2026-84462: Zammad AI Agent Configuration RCE Vulnerability

CVE-2026-84462 Overview

CVE-2026-84462 affects Zammad, a web-based open source helpdesk and customer support system. The vulnerability allows an administrator with permission to create or edit AI Agents to bypass an ERB sanitizer by submitting specially crafted text in an AI Agent field. The bypass results in arbitrary command execution on the Zammad server when the affected AI Agent next processes a ticket. Exploitation requires no interaction from other users. Zammad resolved the issue in version 7.1.2.

Critical Impact
An authenticated administrator can execute arbitrary commands on the host and read, modify, or destroy all data stored by Zammad.

Affected Products

Zammad versions prior to 7.1.2
Zammad AI Agent configuration subsystem
Deployments exposing administrator-level access to AI Agents

Discovery Timeline

2026-09-25 - CVE-2026-84462 published to the National Vulnerability Database (NVD)
2026-09-28 - Last updated in NVD database

Technical Details for CVE-2026-84462

Vulnerability Analysis

The flaw sits in Zammad's ERB (Embedded Ruby) sanitizer, which is responsible for neutralizing ERB tag delimiters inside user-controllable AI Agent fields. The sanitizer attempted to escape the opening ERB sequence <% by replacing it with <%%, but used String#sub, which only replaces the first occurrence. An attacker who supplies input containing multiple <% sequences leaves subsequent instances untouched, allowing injected ERB code to execute during template evaluation.

When the AI Agent later processes a ticket, Zammad renders the attacker-controlled template server-side. The embedded Ruby runs in the Zammad application context, granting the attacker command execution on the host. The vulnerability is categorized under CWE-20: Improper Input Validation.

Root Cause

The root cause is an incomplete sanitization routine in lib/erb_sanitizer.rb. Using sub instead of gsub meant only the first <% was escaped per tag, leaving a reliable injection primitive for any field processed by the sanitizer.

Attack Vector

An attacker needs an administrator account with permission to create or edit AI Agents. The attacker places crafted text containing multiple ERB opening sequences into an AI Agent field. The payload is stored and later evaluated when the agent processes a ticket, resulting in automatic server-side code execution without any additional user interaction.

ruby

   end
 
   def escape_tag(tag)
-    tag.sub('<%', '<%%')
+    tag.gsub('<%', '<%%')
   end
 end

Source: GitHub Commit e3b0c8d

The patch replaces sub with gsub, ensuring every <% occurrence in a tag is escaped rather than only the first.

Detection Methods for CVE-2026-84462

Indicators of Compromise

AI Agent configuration records containing ERB delimiters such as <%, <%=, or %> within text fields
Unexpected child processes spawned by the Zammad Ruby application process
Outbound network connections from the Zammad host to unknown destinations shortly after AI Agent executions
Modifications to AI Agent entries by administrator accounts that do not normally edit them

Detection Strategies

Audit the Zammad database for AI Agent records whose fields contain ERB tag syntax and review their edit history
Correlate administrator activity logs with AI Agent create or update events preceding anomalous ticket processing
Monitor the Zammad application process for execution of shell interpreters such as sh, bash, or curl

Monitoring Recommendations

Enable verbose logging on AI Agent configuration changes and forward events to a centralized SIEM
Alert on process-lineage anomalies where the Zammad Ruby worker spawns operating system commands
Track administrator session activity and flag out-of-hours modifications to AI Agent definitions

How to Mitigate CVE-2026-84462

Immediate Actions Required

Upgrade Zammad to version 7.1.2 or later without delay
Review all existing AI Agent configurations for ERB syntax and remove any suspicious entries
Rotate administrator credentials and audit the administrator role membership
Inspect the Zammad host for signs of command execution, persistence, or data exfiltration

Patch Information

The fix is published in Zammad 7.1.2. The code change is tracked in GitHub Commit e3b0c8d and documented in GitHub Security Advisory GHSA-gp3x-9xm8-rcj6. The patch updates escape_tag in lib/erb_sanitizer.rb to use gsub so all ERB opening sequences are escaped.

Workarounds

Restrict AI Agent create and edit permissions to a minimal set of trusted administrators until the upgrade is applied
Disable AI Agents that are not actively required to reduce the server-side template evaluation surface
Place the Zammad administrative interface behind network restrictions such as VPN or IP allow-listing

bash

# Verify the running Zammad version after upgrade
zammad run rails runner 'puts Zammad::Version.get'
# Expected output: 7.1.2 or later