OTRS Community Edition CVE-2026-53804

Exploitation requires valid OTRS administrator-level credentials - full admin access, not merely an agent or customer account. The PGP encryption module must be enabled and reachable via the OTRS admin configuration panel. The malicious configuration must be saved before the injected command can trigger; the command executes during subsequent ticket operations that invoke PGP processing, meaning exploitation is a two-phase process: configure, then wait for or trigger a PGP ticket event. Limiting factors include the PR:H authentication barrier (no path for unauthenticated or low-privilege exploitation), the dependency on the PGP module being active, and the need for a triggering ticket operation post-configuration. The attack originates over the network (AV:N) via the OTRS web interface; local system access is not required, but admin panel network reachability is.

The CVSS 4.0 score of 8.6 (AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H) reflects a high-severity vulnerability that is nonetheless gated behind full administrator authentication - the PR:H requirement materially reduces opportunistic exploitation risk compared to unauthenticated or low-privilege flaws of equivalent CVSS impact. No EPSS score was provided in the input data, so probabilistic exploitation likelihood cannot be assessed quantitatively. The vulnerability is not listed in CISA KEV at time of analysis, indicating no confirmed widespread active exploitation. A researcher disclosure exists at h00die-gr3y.github.io, suggesting public research and possibly POC-level material, but full working exploit status is not independently confirmed from the available references alone. Real-world risk is highest where OTRS admin credentials are weakly protected, shared across teams, or exposed to phishing - environments relying on single-factor authentication for the admin panel should treat this as a priority. The SC:N/SI:N/SA:N metrics indicate no confirmed lateral scope change beyond the hosting system, though web-server-process-level code execution may provide a pivot point depending on network architecture.

An attacker who has obtained OTRS administrator credentials - via phishing, credential reuse, or insider access - navigates to the PGP module configuration panel and sets the binary path or command options field to include a shell injection payload such as appending a semicolon followed by a reverse-shell or download-and-execute command. Once the configuration is saved, the injected OS command executes as the web server process user the next time a ticket operation invokes PGP functionality. A researcher disclosure at h00die-gr3y.github.io suggests POC-level detail may be publicly available.