Zammad is an open-source helpdesk that puts email, chat, phone, SMS and messaging apps into one ticket system. It suits support and IT teams that want to self-host for free under AGPL-3.0, or rent it from Zammad GmbH. Hosted plans cost EUR 7, 16 or 25 per agent a month billed yearly, excluding VAT.
On 2 October 2026 the US agency CISA added two Zammad flaws, CVE-2026-102489 (session fixation) and CVE-2026-102490 (improper privilege management), to its Known Exploited Vulnerabilities catalog. The Dutch Institute for Vulnerability Disclosure (DIVD) reported that attackers chained them against its own Zammad server in September 2026.
SecurityWeek reports that versions 6.3.0 to 6.5.4 are exploitable and that DIVD advised upgrading to Zammad 7 or taking older installs offline. If you self-host, upgrade to the current release and watch Zammad's GitHub security advisories. When we checked on 4 October 2026, that advisory list did not yet include these two CVEs.
Checked October 4, 2026
The bottom line
A strong free helpdesk if you can host and patch it; the hosted plans are good value for small teams.
7.8
Our score
7.8 / 10
Conversion Gems editorial verdict
Free self-hosted; hosted from EUR 7/agent/mo yearly
Features8/10
8 - eight channels, knowledge base, SLAs, triggers, time accounting, SSO and optional AI.
Value9/10
9 - free when self-hosted; hosted from EUR 7 per agent a month.
Ease of use6/10
6 - hosted setup is quick, but self-hosting needs Linux or Docker skills and ongoing patching.
Ecosystem8/10
8 - Microsoft 365, Teams, Slack, GitHub, GitLab, LDAP, SAML, OpenID Connect, monitoring tools, REST API and webhooks.
Support7/10
7 - docs, community forum, email support on hosted plans, phone on Plus, paid SLAs for self-hosters.
What it really is
An open-source, web-based helpdesk you can run yourself for free or rent as a hosted service from Zammad GmbH.
Our take
Zammad is one of the strongest free helpdesks if you have someone who can run a Linux server: multichannel tickets, a knowledge base, SLAs and SSO all come in the open-source edition. Hosted plans are cheap for small teams but cap agents and hold WhatsApp and Facebook for the top tier. The October 2026 exploited flaws are a reminder that self-hosting means owning updates.
Why we rate it
It packs multichannel ticketing, SLAs, a knowledge base and many integrations into free, open-source software.
The catch
Self-hosters own security patching, and hosted plans cap agents and reserve some channels for Plus.
Best for
Teams that want a free self-hosted helpdesk
European support teams paying in euros
IT teams linking tickets to monitoring and GitHub
Not good for
Teams with no one to run and patch a Linux server who also need more than 35 agents on a budget
Windows-only server shops
Friction report
Time to value
Hours for hosted (sign up and connect a mailbox); a day or more for self-hosting with Docker or packages and Elasticsearch.
Scale breakpoint
Hosted Starter stops at 5 agents and Professional at 35; WhatsApp and Facebook channels need Plus.
Walled garden
Low: open-source code, REST API and webhooks; you can move between hosted and self-hosted.
From Zammad's pricing page and zammad.org, checked 4 October 2026. Prices exclude VAT. Optional AI features cost EUR 0.03 per AI call.
Frequently Asked Questions
The software is free and open source (AGPL-3.0) if you host it yourself on Linux or Docker. Zammad's hosted plans cost EUR 7, 16 or 25 per agent a month billed yearly (EUR 9, 18 or 27 monthly), excluding VAT (checked 4 October 2026).
Hosted: Starter v2 EUR 7 per agent a month (up to 5 agents), Professional v2 EUR 16 (up to 35), Plus v2 EUR 25 (unlimited), all billed yearly. Optional AI costs EUR 0.03 per call. Support contracts for self-hosters run EUR 2,999 to 9,999 a year (checked 4 October 2026).
zammad.org offers packages for Ubuntu, Debian and CentOS, a Docker Compose setup and a source install. There is no Windows or macOS installer. The Professional hosted plan has a 30-day free trial if you would rather not run a server.
CISA added CVE-2026-102489 and CVE-2026-102490 in Zammad to its Known Exploited Vulnerabilities catalog on 2 October 2026. SecurityWeek reports versions 6.3.0 to 6.5.4 as exploitable. Self-hosters should upgrade to the latest release and follow Zammad's GitHub security advisories.
Zammad was started by Martin Edenhofer, who earlier created OTRS. It is developed by Zammad GmbH with an open-source community, and the name comes from Bavarian for 'together'.
It depends on your team. Zammad suits customer-facing support across many channels. For IT service management with asset tracking, ManageEngine ServiceDesk Plus has a free edition for up to five technicians.
Zammad alternatives
Other helpdesk tools to compare:
Zendesk: A large cloud customer service suite with ticketing, messaging and AI.
ServiceDesk Plus: ManageEngine's IT service desk with a free edition and an on-premises option.
Hiver: A helpdesk that runs inside Gmail for teams that live in shared inboxes.
TOPdesk: IT and facilities service management with ticketing and workflows.
