What is the CVSS score of EUVD-2026-33552?

EUVD-2026-33552 has a CVSS 3.1 base score of 9.1 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.1%.

Which versions of OTRS are affected by EUVD-2026-33552?

OTRS and OTRS Community Edition contain a critical SQL injection vulnerability that allows unauthenticated attackers to bypass authentication entirely, exposing all customer support tickets and…

How to fix or mitigate EUVD-2026-33552?

Within 24 hours: Identify all OTRS instances in production and determine which database configurations use NO_BACKSLASH_ESCAPES SQL mode. Within 7 days: If NO_BACKSLASH_ESCAPES is enabled and operationally feasible, disable it; implement WAF rules to block SQL injection patterns; restrict network access to OTRS if possible; enable detailed logging of authentication attempts. Within 30 days: Monitor vendor advisories for patch release (no timeline currently disclosed); conduct security audit of OTRS permissions and data access; evaluate temporary service restriction until patch available.

OTRS EUVD-2026-33552

| CVE-2026-48188 CRITICAL

Improper Input Validation (CWE-20)

2026-06-01 OTRS

GHSA-4vhj-5qc2-97wr

SQLi Authentication Bypass Otrs Otrs Community Edition

9.1

CVSS 3.1 · Vendor: OTRS

Severity by source

Vendor (OTRS) PRIMARY

9.1 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Primary rating from Vendor (OTRS) · only source for this CVE.

CVSS VectorVendor: OTRS

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 01, 2026 - 04:21 vuln.today

CVE Published

Jun 01, 2026 - 03:33 nvd

CRITICAL 9.1

DescriptionCVE.org

An improper Input Validation vulnerability in OTRS or ((OTRS)) Community Edition database layer module allows an unauthenticated SQL injection which can lead to an authentication bypass. This issue only affects the system if the MySQL/MariaDB server is configured with the NO_BACKSLASH_ESCAPES SQL mode.

This issue affects OTRS:

7.0.X
8.0.X
2023.X
2024.X
2025.X
2026.X before 2026.4.X
(OTRS)) Community Edition: 6.0.x

Products based on the ((OTRS)) Community Edition also very likely to be affected

AnalysisAI

Unauthenticated SQL injection in OTRS and the legacy ((OTRS)) Community Edition database layer enables authentication bypass when the backing MySQL/MariaDB instance runs with the NO_BACKSLASH_ESCAPES SQL mode. The flaw carries a CVSS of 9.1 with network-reachable, no-privileges-required exploitation against confidentiality and integrity, but no public exploit identified at time of analysis and the issue is gated by a specific non-default database configuration.

Technical ContextAI

OTRS is a widely deployed open-source ticketing and helpdesk platform written in Perl; the ((OTRS)) Community Edition is its legacy community-maintained fork (the 6.0.x line). The root cause is CWE-20 Improper Input Validation in the database abstraction layer: OTRS's escaping logic assumes the standard MySQL/MariaDB behavior of treating backslash as an escape character within string literals. When the database session is started with the NO_BACKSLASH_ESCAPES SQL mode, backslashes are treated literally, so the application's quote-escaping no longer neutralizes attacker-supplied single quotes, allowing breakout of the string context and arbitrary SQL clause injection. Because the injection sits in pre-authentication code paths, an attacker can manipulate the login query to bypass authentication entirely. CPE coverage confirms cpe:2.3:a:otrs_ag:otrs and cpe:2.3:a:otrs_ag:((otrs))_community_edition as the affected products.

RemediationAI

Vendor-released patch: upgrade OTRS to the 2026.4.X line per OTRS Security Advisory 2026-02 (https://otrs.com/release-notes/otrs-security-advisory-2026-02/); the 7.0.X, 8.0.X, 2023.X, 2024.X, and 2025.X branches and ((OTRS)) Community Edition 6.0.x are listed as affected without a clearly enumerated fix release in the available data, so customers on those lines should contact OTRS support or migrate to the patched 2026.4.X line. As an immediate compensating control, inspect the backing MySQL/MariaDB sql_mode (SELECT @@sql_mode) and remove NO_BACKSLASH_ESCAPES from both global and session modes - this neutralizes the precondition for this specific bug but may break applications that intentionally rely on standard-SQL string semantics, so test before deploying. Additional defense-in-depth options include restricting network access to the OTRS web frontend to trusted IP ranges or placing it behind a WAF tuned for SQLi patterns on login endpoints, accepting that WAF coverage of NO_BACKSLASH_ESCAPES-mode injections may be incomplete.