Vulnerabilities found in Zammad

Two zero-day vulnerabilities have been found in Zammad. They have been actively exploited since at least 21 September 2026 to obtain remote root access on the system running Zammad.