CISA Flags Zammad Ticketing System Vulnerabilities in Its Exploited‑Vulnerabilities List

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has officially added a set of security flaws affecting Zammad GmbH's Zammad ticketing platform to its Known Exploited Vulnerabilities (KEV) catalog. The inclusion signals that threat actors are actively leveraging these weaknesses, prompting federal agencies and private organizations alike to reassess their exposure to the open‑source help‑desk solution.

Zammad is a widely adopted, open‑source customer support and issue‑tracking system used by businesses, NGOs, and government bodies to manage service requests and internal communications. Because it often handles sensitive user data and integrates with other enterprise tools, any compromise can provide attackers a foothold into broader networks. The newly cataloged flaws could enable unauthorized access, data leakage, or execution of malicious code, depending on how they are exploited.

CISA’s KEV catalog serves as a central repository of vulnerabilities that have been observed in the wild and are known to be weaponized. By publishing this list, the agency helps organizations prioritize patching efforts, align security controls, and allocate resources to mitigate the most pressing threats. In recent months, the catalog has expanded to include vulnerabilities across a range of software categories, reflecting a growing emphasis on proactive cyber defense across the public and private sectors.

The announcement was first reported by Security Affairs, a cybersecurity news outlet that tracks emerging threats and vendor disclosures. Security experts have urged administrators of Zammad deployments to review the agency’s guidance, apply any available patches, and consider additional hardening measures such as network segmentation and multi‑factor authentication. Failure to address the flaws could leave organizations vulnerable to credential theft, privilege escalation, or lateral movement within their environments.

Looking ahead, CISA is expected to continue updating the KEV list as new exploit activity is identified, and it encourages stakeholders to monitor the catalog regularly. For organizations relying on Zammad, the immediate recommendation is to verify that they are running the latest supported version, consult vendor advisories, and incorporate threat‑intelligence feeds into their security operations. Timely remediation remains a critical component of broader efforts to reduce the attack surface and safeguard essential digital services.