Vulnerability in OTRS GmbH (former OTRS AG) OTRS

[ Description ]Official description

An OTRS administrator can enter arbitrary JavaScript into the content of an OTRS Custom Page, which is stored by the application and subsequently executed in the browser of users accessing that page. This issue affects OTRS: * 7.0.X * 8.0.X * 2023.X * 2024.X * 2025.X * 2026.X before 2026.7.X

[ Fixes ]Fixes and patches

No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.

[ Advisories ]Government CERT advisories

• BSI CERT-Bund11 Oct 2026WID-SEC-2026-3872

  OTRS: Multiple vulnerabilities Translated from German

  CVE-2026-78358CVE-2026-93582CVE-2026-78357+6 more CVEs

[ References ]References

• otrs.com/release-notes/otrs-security-advisory-2026-11