A flaw in Zammad’s AI Agent configuration sanitizer allows an administrator to submit crafted input that bypasses security checks and injects arbitrary commands. Once the malicious AI Agent processes a ticket, the injected commands run automatically on the host server, enabling the attacker to read, modify, or delete any data stored on that system. The attack exploits input validation and code execution weaknesses and requires only administrative privileges for AI Agent creation or editing.

The vulnerability affects the open source Helpdesk platform Zammad, specifically versions prior to 7.1.2 for all operating systems that run the web application. The exact CPE strings are omitted for brevity, but the CNA product name is "zammad:zammad". The fix is implemented in Zammad 7.1.2 and newer releases.

The CVSS score of 8.6 indicates a high severity. The EPSS score is not available, so the likelihood of exploitation cannot be quantified at this time. The vulnerability is not listed in the CISA KEV catalog. Attackers would need to authenticate as an administrator with permission to create or edit AI Agents, but no interaction from other users is required. Once the administrator submits the malicious input, the code executes automatically during subsequent ticket processing, ensuring persistent impact.