Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

Buy Us a Coffee

CVE-2026-56725— Zammad: Denial of Service via OTRS Import Controller

Quick assessment

Affected

zammad zammad

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Zammad 是一款基于 Web 的开源帮助台/客户支持系统。在版本 7.0.2 之前，存在一个未认证请求可导致服务阻塞的安全漏洞。向发起未认证请求时，会阻塞 Zammad 的请求工作进程约两分钟。和操作缺少其他同控制器操作中使用的防护机制，因此它们会在已完全配置的生产环境中直接执行。该操作会针对一个空白的 OTRS 端点进入重试循环，并在每次尝试之间分别休眠 30 秒和 45 秒。影响：未认证的远程攻击者可导致生产环境的 Zammad 实例发生拒绝服务（DoS）。每个请求几乎不消耗资源，但会强制在服务器

CVSS 8.7 · High EPSS 0.41% · P33 Updated Sep 28, 2026

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Zammad: Denial of Service via OTRS Import Controller

Source: CVE Program / CVE List V5

Vulnerability Description

Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.2, summary An unauthenticated request to POST /api/v1/import/otrs/import_check blocks a Zammad request worker for roughly two minutes. The import_check and import_status actions are missing the setup_done_response guard that other actions in the same controller carry, so they execute on fully set-up production instances. The action enters a retry loop against a blank OTRS endpoint, sleeping for 30 s + 45 s between attempts. Impact An unauthenticated remote attacker denies service to a production Zammad instance. Each request costs almost nothing and forces ~115 seconds of server-side blocking. A few requests per second saturate the Puma worker pool. The condition persists as long as the traffic continues. No account, valid import configuration, or target knowledge beyond the hostname is needed. CSRF token is trivially obtained from any prior GET response. This issue is fixed in version 7.0.2.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Source: CVE Program / CVE List V5

Vulnerability Type

关键功能的认证机制缺失

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
zammad	zammad	< 7.0.2	-

II. Public POCs for CVE-2026-56725

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-56725

请登录查看更多情报信息。

Other References for CVE-2026-56725 (3)

https://github.com/zammad/zammad/releases/tag/7.0.2 x_refsource_MISC
https://github.com/zammad/zammad/security/advisories/GHSA-45cx-9mrq-mmcj x_refsource_CONFIRM
https://github.com/zammad/zammad/commit/a04a95b69496306af4c1fbd369a54981122e67c0 x_refsource_MISC

https://www.cve.org/CVERecord?id=CVE-2026-56725

Same Patch Batch · zammad · 2026-09-25 · 30 CVEs total

CVE-2026-84458	9.1 CRITICAL	Zammad: Account takeover via unverified email matching during SSO auto-link
CVE-2026-61525	8.8 HIGH	Zammad: Arbitrary File Deletion via Unvalidated Session Identifier in Long Polling Control
CVE-2026-56733	8.7 HIGH	Zammad: Incorrect Authorization and Improper Privilege Management
CVE-2026-84462	8.6 HIGH	Zammad: AI Agent template sanitizer bypass leads to remote code execution
CVE-2026-56731	8.4 HIGH	Zammad: Cross-Site Scripting in Ticket Notifications
CVE-2026-56724	7.1 HIGH	Zammad: Incorrect implementation of permission checks in the knowledge base module
CVE-2026-84465	7.1 HIGH	Zammad: S/MIME signature verification allows forged sender impersonation
CVE-2026-84464	7.1 HIGH	Zammad: IDOR in External Data Source rendering exposes ticket, user, group, and organizati
CVE-2026-56727	7.1 HIGH	Zammad: PGP signature spoofing via unvalidated verification return
CVE-2026-56723	7.1 HIGH	Zammad: Missing authorization on ticket attachment download
CVE-2026-63207	6.9 MEDIUM	Zammad: Sensitive Information Exposure in Integration Administration API
CVE-2026-84461	6.9 MEDIUM	Zammad: Missing rate limiting allows password brute-forcing during two-factor login
CVE-2026-84463	6.3 MEDIUM	Zammad: Stored HTML injection in Knowledge Base video widget enables forced session switch
CVE-2026-56728	5.3 MEDIUM	Zammad: Cross-User Taskbar Item Access Control Vulnerability
CVE-2026-56735	5.3 MEDIUM	Zammad: Improper neutralization of `srcset` attribute in IMG tags in Zammad
CVE-2026-63206	5.3 MEDIUM	Zammad: Remote image tracking bypass via shortened URL scheme
CVE-2026-56734	5.3 MEDIUM	Zammad: Avatar Image URL Server-Side Request Forwarding
CVE-2026-56732	5.3 MEDIUM	Zammad: Malicious input in Ticket Body Enables Session Termination
CVE-2026-84460	5.3 MEDIUM	Zammad: Missing Authorization in TagsController#list Allows Cross-Object Tag Enumeration
CVE-2026-61855	5.3 MEDIUM	Zammad: Invalid PGP Detached Signatures Reported as Good Signature on Inbound Mail

Showing top 20 of 30 CVEs. View all on vendor page → →

IV. Related Vulnerabilities

Same product: zammad

Same vendor: zammad

Same weakness: CWE-306

V. Comments for CVE-2026-56725

No comments yet

Goal Reached Thanks to every supporter — we hit 100%!

CVE-2026-56725— Zammad: Denial of Service via OTRS Import Controller

Quick assessment

I. Basic Information for CVE-2026-56725

Vulnerability Information

Vulnerability Title

Vulnerability Description

CVSS Information

Vulnerability Type

Affected Products

II. Public POCs for CVE-2026-56725

III. Intelligence Information for CVE-2026-56725

Other References for CVE-2026-56725 (3)

Same Patch Batch · zammad · 2026-09-25 · 30 CVEs total

IV. Related Vulnerabilities

V. Comments for CVE-2026-56725

Leave a comment