Log in Start free

Vulnerability · Published Jun 1, 2026 · Assigned by OTRS

CVE-2026-48209Reflected XSS in authenticated agent context

High 7.1

In plain English

A high-severity cross-site scripting in OTRS from OTRS AG. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 10% of all known vulnerabilities).

Severity (CVSS 3.1)7.1High
Exploit odds (30 days)0.2%top 89.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

An improper neutralization of user-controllable input in OTRS or ((OTRS)) Community Edition ticket handling allows authenticated attackers to perform reflected cross-site scripting (XSS) attacks via crafted request parameters associated with ticket actions. By injecting malicious JavaScript into manipulated request URLs, attackers can execute arbitrary script code in the context of an authenticated agent session when the crafted link is opened. This issue affects OTRS: * 7.0.x Please note that ((OTRS)) Community Edition 6.x and before are vulnerable. Products based on the ((OTRS)) Community Edition also very likely to be affected

Affected products (as reported)

VendorProductVersions
OTRS AG OTRS 7.0.x
OTRS AG ((OTRS)) Community Edition 6.x

Weakness: CWE-79, CWE-116 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:N

References