CVE-2026-84461 zammad CVE debrief

Who should care

Defenders responsible for Zammad installations should assess exposure and prioritize upgrading to version 7.1.2 or later. They should also review compensating controls for exposed systems while remediation is scheduled and verified. Security teams should track exceptions, retest remediated assets, and close the item only after evidence is documented.

Why it matters

CVE-2026-84461 allows attackers to brute-force weak or reused passwords in Zammad installations prior to version 7.1.2, potentially leading to unauthorized access.

• Brute-force attacks on weak or reused passwords are possible
• Unlimited password guesses can be attempted without triggering lockout or rate limiting
• Response reveals whether a guess was correct, aiding attackers

Technical summary

The vulnerability in Zammad allows an attacker to try unlimited password guesses for any account without triggering Zammad's normal lockout or rate limiting. The response also reveals whether a guess was correct, even before two-factor authentication is checked. This made it possible to brute-force weak or reused passwords. Defenders should prioritize verifying exposure of Zammad installations to this vulnerability and upgrading to version 7.1.2 or later. The vulnerability has a CVSS score of 6.9 and a severity of MEDIUM.

Defensive priority

Defenders should prioritize verifying exposure of Zammad installations to this vulnerability and upgrading to version 7.1.2 or later.

Recommended defensive actions

• Verify Zammad installations for exposure to this vulnerability
• Upgrade to version 7.1.2 or later
• Implement additional security measures to prevent brute-force attacks
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record and NVD vulnerability detail page provide information on the vulnerability, its impact, and the fixed version. Defenders should verify the exposure of Zammad installations to this vulnerability and review the official advisory for affected scope, severity, and vendor guidance. The evidence limits of this debrief are based on the supplied source corpus and CVE record. To confirm affected product deployments, assign an owner for follow-up and review compensating controls for exposed systems while remediation is scheduled.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.