What is the CVSS score of CVE-2026-48209?

CVE-2026-48209 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:N. EPSS exploitation probability: 0.0%.

Which versions of OTRS are affected by CVE-2026-48209?

OTRS ticketing systems (versions 7.0.x and Community Edition 6.x and earlier) contain a reflected XSS vulnerability that allows attackers to execute malicious code in authenticated support agent…

How to fix or mitigate CVE-2026-48209?

Within 24 hours: Disable external URL previews in ticket notifications and enforce email link filtering policies. Within 7 days: Deploy WAF rules targeting reflected XSS payloads in ticket URLs; implement restrictive Content Security Policy (CSP) headers; conduct security awareness training on URL validation. Within 30 days: Monitor OTRS vendor advisories for patch availability; evaluate upgrade to patched versions or migration to alternative ticketing platforms when updates are released.

OTRS CVE-2026-48209

EUVD-2026-33547 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-06-01 OTRS

GHSA-hwvj-jp99-g693

XSS Otrs Otrs Community Edition

7.1

CVSS 3.1 · Vendor: OTRS

Severity by source

Vendor (OTRS) PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:N

Primary rating from Vendor (OTRS) · only source for this CVE.

CVSS VectorVendor: OTRS

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 01, 2026 - 04:20 vuln.today

DescriptionCVE.org

An improper neutralization of user-controllable input in OTRS or ((OTRS)) Community Edition ticket handling allows authenticated attackers to perform reflected cross-site scripting (XSS) attacks via crafted request parameters associated with ticket actions. By injecting malicious JavaScript into manipulated request URLs, attackers can execute arbitrary script code in the context of an authenticated agent session when the crafted link is opened.

This issue affects OTRS:

7.0.x

Please note that ((OTRS)) Community Edition 6.x and before are vulnerable. Products based on the ((OTRS)) Community Edition also very likely to be affected

AnalysisAI

Reflected cross-site scripting in OTRS 7.0.x and ((OTRS)) Community Edition 6.x and earlier allows remote attackers to execute arbitrary JavaScript in an authenticated agent's browser session by tricking the agent into clicking a crafted ticket-action URL. The CVSS 7.1 (UI:R) rating reflects the need for victim interaction, and no public exploit identified at time of analysis, but the high integrity impact and the ubiquity of OTRS-derived help-desk forks make this a meaningful risk for ticketing environments.

Technical ContextAI

OTRS is a widely deployed PHP/Perl-based ticketing and help-desk platform; the ((OTRS)) Community Edition is the open-source lineage from which numerous forks (e.g., Znuny, OTOBO) derive, so weaknesses in the ticket-action handlers tend to propagate downstream. CWE-79 (Improper Neutralization of Input During Web Page Generation) describes the root cause: request parameters tied to ticket actions are reflected back into agent-facing pages without sufficient HTML/JS encoding, letting attacker-controlled strings be parsed as script. The affected CPEs cover cpe:2.3:a:otrs_ag:otrs and cpe:2.3:a:otrs_ag:((otrs))_community_edition, confirming both the commercial OTRS line and its community ancestor are in scope.

RemediationAI

Patch availability is indicated by the existence of OTRS Security Advisory 2026-08 (https://otrs.com/release-notes/otrs-security-advisory-2026-08/), so administrators should upgrade OTRS 7.0.x to the fixed release listed in that advisory; an exact fix version is not provided in the input data, so consult the advisory directly before scheduling deployment. Operators of ((OTRS)) Community Edition 6.x and earlier should note that 6.x is end-of-life and migrate to a supported fork (Znuny, OTOBO) on a release that has back-ported the fix. Compensating controls while patching: enforce a strict Content-Security-Policy that disallows inline scripts on agent pages (side effect: may break legacy customer themes and dashboard widgets), restrict the agent interface to a VPN or IP allow-list (side effect: hampers remote agents), and train agents to verify ticket-action URLs before clicking, particularly links arriving via email or external chat.