zammad
Zammad session-hijack RCE and root escalation are under active exploitation
Two critical Zammad CVEs (9.4 CVSS 4.0) are in the CISA KEV catalog, and one was used to breach a Dutch government agency on 21 Sep 2026. Upgrade to the fixed release or take the instance offline.