CVE-2026-61855 zammad CVE debrief

Who should care

Defenders who manage Zammad installations, particularly those who rely on PGP-signed emails for authentication, should assess the trustworthiness of incoming mail and verify the authenticity of email content.

Why it matters

CVE-2026-61855 is a vulnerability in Zammad that affects the verification of inbound PGP-signed emails, potentially leading to incorrect assessment of email trustworthiness. Defenders should verify email authenticity, assess email content trustworthiness, and prioritize updating to version 7.1.2 or later.

• Defenders need to verify the authenticity of incoming PGP-signed emails to ensure the trustworthiness of email content.
• The vulnerability may lead to incorrect assessment of email trustworthiness, potentially affecting incident response and email filtering.
• Defenders should prioritize updating to version 7.1.2 or later to fix the vulnerability.

Technical summary

The vulnerability occurs in Zammad versions 7.0.3 and 7.1.1, where the verification of inbound PGP-signed email can mark a message as carrying a valid PGP signature from a registered sender key, even though the displayed message content is not actually covered by that signature. This issue can lead to incorrect assessment of email trustworthiness, potentially affecting incident response and email filtering. Defenders should prioritize verifying the authenticity of incoming PGP-signed emails and assess the trustworthiness of email content. The issue is fixed in version 7.1.2.

Defensive priority

Defenders should prioritize verifying the authenticity of incoming PGP-signed emails and assess the trustworthiness of email content.

Recommended defensive actions

• Verify the authenticity of incoming PGP-signed emails
• Assess the trustworthiness of email content
• Update to version 7.1.2 or later
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD vulnerability detail page provide information on the vulnerability. However, defenders need to verify the authenticity of incoming PGP-signed emails and assess the trustworthiness of email content. The impact and remediation require verification from the supplied official sources, including CVE Program and NIST NVD. The vulnerability affects Zammad versions 7.0.3 and 7.1.1. Limited source detail is provided, so defenders should exercise caution when evaluating the vulnerability.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.