[ Vendor · 9 CVEs ]
OTRS GmbH (former OTRS AG)
CVEs affecting OTRS GmbH (former OTRS AG) published in the last 30 days, plus any OTRS GmbH (former OTRS AG) CVE on CISA's exploited list.
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2026-78357 | 12 Oct 2026 | CVSS 9.1 | OTRS GmbH (former OTRS AG) OTRSPreviously issued authentication tokens are not immediately invalidated when an OTRS agent or customer user account is deactivated or its password is… | |
| CVE-2026-78358 | 12 Oct 2026 | CVSS 4.3 | OTRS GmbH (former OTRS AG) OTRSSeveral administrative actions do not sufficiently validate whether a request was intentionally initiated by the authenticated user. In particular… | |
| CVE-2026-78359 | 12 Oct 2026 | CVSS 5.4 | OTRS GmbH (former OTRS AG) OTRSOTRS does not sufficiently enforce the uniqueness of customer user identities across multiple configured CustomerUser backends. When multiple… | |
| CVE-2026-93581 | 12 Oct 2026 | CVSS 6.1 | OTRS GmbH (former OTRS AG) OTRSUser-controlled values are not sufficiently neutralized when included in CSV exports. Values originating from user input, including data submitted by… | |
| CVE-2026-93582 | 12 Oct 2026 | CVSS 9.4 | OTRS GmbH (former OTRS AG) OTRSThe HTTP Basic Authentication modules in ((OTRS)) Community Edition 6 and prior accept the authenticated username from either the REMOTE_USER or… | |
| CVE-2026-48211 | 12 Oct 2026 | CVSS 5.4 | OTRS GmbH (former OTRS AG) OTRSAn authenticated administrator can be induced to delete administrative Import/Export templates through a Cross-Site Request Forgery (CSRF) attack… | |
| CVE-2026-48212 | 12 Oct 2026 | CVSS 4.8 | OTRS GmbH (former OTRS AG) OTRSAn OTRS administrator can enter arbitrary JavaScript into the content of an OTRS Custom Page, which is stored by the application and subsequently… | |
| CVE-2026-78355 | 12 Oct 2026 | CVSS 8.7 | OTRS GmbH (former OTRS AG) OTRSA path traversal vulnerability in the OTRS SendSupportBundle functionality allows an authenticated administrator to reference file paths outside the… | |
| CVE-2026-78356 | 12 Oct 2026 | CVSS 5.3 | OTRS GmbH (former OTRS AG) OTRSThe OTRS Agent Frontend configuration endpoint can be accessed without authentication. This allows unauthenticated remote users to retrieve internal… |