Why Zammad 6.5 matters now for support teams choosing between Zendesk and Freshdesk

CISA added two Zammad vulnerabilities to the Known Exploited Vulnerabilities catalog on October 2, 2026, with a federal remediation deadline of October 5. CVE-2026-102489 affects versions up to 6.5 due to their runtime environment, while CVE-2026-102490 allows local privilege escalation in DEB and RPM packages. This security event forces a hard look at self-hosted alternatives when comparing them against SaaS giants like Zendesk and Freshdesk. The choice is no longer just about feature sets; it is about data ownership and total cost of ownership.

The pricing gap widens when AI switches on

Freshdesk’s paid tiers run $19, $55, and $89 per agent per month on annual billing, but the real cost emerges when you add channels and intelligence. Chat requires Freshchat at $19 or more per agent, phone requires Freshcaller at $15 or more, and the Freddy AI Copilot adds $29 per agent on Pro and Enterprise plans. A ten-agent team on Freshdesk Pro with chat and AI pays $11,160 annually, a figure that excludes storage overages or marketplace app fees. Zendesk sits higher still, with Suite Professional at $115 per agent and Copilot at $50 per agent, before any metered AI usage. Zendesk bills AI agents by "automated resolutions" without publishing a rate, meaning the final bill depends entirely on a sales quote. In contrast, Zammad offers its full stack, including multi-channel support, Elasticsearch-powered search, and SLA management, under a free AGPL-3.0 license. A ten-agent team self-hosting Zammad pays under $500 per year for a VPS, with every feature included. The difference is not marginal; it is an order of magnitude.

The math favors Zammad for any team that values predictable costs. You avoid the hidden line items that accumulate in SaaS contracts, such as per-resolution AI fees or separate licenses for voice and chat. However, this savings comes with operational trade-offs. Freshdesk provides dedicated mobile apps and a 99.9% uptime SLA, whereas Zammad relies on your infrastructure for availability. If your team lacks DevOps expertise, the "free" software can become expensive in labor hours spent managing Docker containers and Elasticsearch reindexing during major version upgrades.

Security and migration realities shape the decision

Zammad 6.5 is out of support, and CISA’s KEV listing makes staying on that version actively dangerous for federal agencies and a compliance risk for everyone else. The vendor advises moving to 7.2.0 or newer immediately, which includes hardening for the session fixation vulnerability. For teams already using Freshdesk or Zendesk, migrating to Zammad is straightforward because of a built-in import tool. You provide your API key and subdomain, and Zammad pulls tickets, agents, contacts, and organizational structure directly. This process preserves conversation history and group structures, though it does not transfer automation rules, custom report templates, or satisfaction survey history. Those elements require manual recreation as Zammad triggers and text modules.

The security posture of self-hosting is different from SaaS. Zammad stores customer PII, mailbox credentials, and SSO tokens locally, making it Tier-0 infrastructure. An attacker who gains access to an old helpdesk box can pivot through those mailboxes to reset other systems. While this gives you complete data ownership, it also means you bear the full burden of patching, secrets rotation, and perimeter defense. Freshdesk hosts data on AWS, transferring that risk to the vendor, but it introduces vendor lock-in and export difficulties. Exporting tickets from Freshdesk requires API scripting, and the longer you stay, the harder migration becomes as workflows accumulate. If you are considering a switch, ask whether your team has the capacity to manage a self-hosted instance or if the convenience of SaaS outweighs the savings. The answer depends on your specific risk tolerance and technical bandwidth.