Is there a public PoC exploit available for CVE-2026-8194?

Yes, a public proof-of-concept exploit is available for CVE-2026-8194. Prioritise patching immediately. EPSS: 0.0%.

Is there a patch available for CVE-2026-8194?

Yes, a patch is available for CVE-2026-8194. Update the affected software to the latest version immediately.

osTicket CVE-2026-8194

Q: What is the CVSS score of CVE-2026-8194?

CVE-2026-8194 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-28938 LOW

Cross-Site Request Forgery (CSRF) (CWE-352)

2026-05-09 VulDB

PHP CSRF

2.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Severity Changed

May 09, 2026 - 20:22 NVD

MEDIUM LOW

CVSS changed

May 09, 2026 - 20:22 NVD

4.3 (MEDIUM) 2.1 (LOW)

Source Code Evidence Fetched

May 09, 2026 - 20:00 vuln.today

Analysis Generated

May 09, 2026 - 20:00 vuln.today

CVE Published

May 09, 2026 - 19:30 nvd

MEDIUM 4.3

DescriptionCVE.org

A security vulnerability has been detected in osTicket up to 1.18.3. Impacted is an unknown function of the file include/class.dispatcher.php of the component Dispatcher. The manipulation of the argument _method leads to cross-site request forgery. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through a pull request but has not reacted yet.

AnalysisAI

Cross-site request forgery in osTicket up to version 1.18.3 allows remote attackers to bypass CSRF token validation by manipulating the _method parameter via GET requests, enabling unauthorized state-changing operations without user interaction beyond clicking a malicious link. The vulnerability exploits improper HTTP method emulation in the Dispatcher component and has publicly available proof-of-concept code; a vendor patch is available.

Technical ContextAI

osTicket's Dispatcher component (include/class.dispatcher.php) implements HTTP method emulation to support method override functionality, commonly used in REST APIs and form-based applications. The vulnerable code accepts the _method parameter from the GET query string and uses it to override the REQUEST_METHOD server variable before CSRF token validation occurs. This allows attackers to craft requests that appear to be GET requests (which are not protected by CSRF tokens in most frameworks) but are internally processed as POST, PUT, or DELETE requests, bypassing the CSRF protection mechanism that depends on request method validation. The root cause is CWE-352 (Cross-Site Request Forgery), specifically a failure to validate CSRF tokens before method emulation takes effect. The fix restricts _method to POST body parameters only, ensuring CSRF token validation runs before any method override is processed.

RemediationAI

Upgrade osTicket to the patched version released after pull request #6945 (exact version number not explicitly stated in references but the PR is confirmed merged). The fix restricts the _method parameter to POST body only, ensuring CSRF token validation runs before method emulation. As an interim workaround pending upgrade, restrict network access to osTicket administrative interfaces via IP whitelisting, disable the HTTP method emulation feature if not actively used (requires code modification or configuration hardening), or apply Web Application Firewall rules to block requests with _method in the query string. Each workaround has trade-offs: IP restrictions may hinder remote administration, disabling features risks breaking legitimate functionality, and WAF rules can introduce false positives. Administrators should verify their osTicket version against the affected range and apply the patch at the earliest maintenance window.