Dear Community,
We have released Zammad 6.5.5, an exceptional security update addressing a critical vulnerability in the unsupported 6.5 series.
This update hardens the WebSocket server code to address CVE-2026-102489 and provides an emergency fix for users who cannot immediately upgrade to a supported Zammad version.
Please note: Zammad 6.5 has reached end of support. This update is a security measure and does not extend its support lifecycle.
What You Need to Do
- Running Zammad 6.5? Update to 6.5.5 immediately if upgrading to Zammad 7.2.2 is not yet possible.
- All self-hosted users: We strongly recommend upgrading to Zammad 7.2.2 as soon as possible.
- Zammad SaaS customers: No action is required.
Important: Package Repository Migration
Zammad 6.5.5 is available through a new package repository. Before updating, you must switch repositories and remove the old repository and its signing key. Otherwise, your package manager may continue using the old repository, which provides packages from a newer release series.
Please follow our repository migration instructions.
Thank you for keeping your Zammad installations secure! 