Vulnerability · Published Apr 20, 2026 · Assigned by OTRS
CVE-2026-6060Possible DoS via SQL Box
Medium 4.5
In plain English
A medium-severity uncontrolled resource consumption in OTRS from OTRS AG. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 9% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.
Official description
A vulnerability in the SQL Box in the admin interface of OTRS leads to an uncontrolled resource consumption leading to a DoS against the webserver. will be killed by the systemThis issue affects OTRS: * 7.0.X * 8.0.X * 2023.X * 2024.X * 2025.X * 2026.X before 2026.3.X
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu:22.04:LTS | otrs2 | no fix listed | UBUNTU-CVE-2026-6060 |
| Ubuntu:24.04:LTS | znuny | no fix listed | UBUNTU-CVE-2026-6060 |
| Ubuntu:25.10 | znuny | no fix listed | UBUNTU-CVE-2026-6060 |
| Ubuntu:26.04:LTS | znuny | no fix listed | UBUNTU-CVE-2026-6060 |
| Ubuntu:26.10 | znuny | no fix listed | UBUNTU-CVE-2026-6060 |
Affected products (as reported)
Weakness: CWE-400, CWE-770 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:N/A:H