OTRS EUVD-2026-97264

Exploitation requires an authenticated OTRS administrator account with permission to create or edit Custom Pages, since the malicious JavaScript can only be stored via that administrative feature (PR:H). It further requires a second user to actively navigate to the affected Custom Page for the stored payload to execute (UI:R). Limiting factors: no unauthenticated or low-privilege path exists to inject the payload, the attacker must already hold admin rights (or subvert an admin), and no impact occurs until a victim loads the specific page. Applies to default installations of OTRS versions 7.0.X, 8.0.X, and 2023.X through 2026.X prior to 2026.7.X.

This is a low-to-moderate priority issue, not a high-urgency one. The provided CVSS 3.1 vector (CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N, base 4.8/Medium) is internally consistent with the description: exploitation requires an OTRS administrator (PR:H) to inject the payload, and a victim must then load the affected Custom Page (UI:R), with scope change (S:C) reflecting that the injected JavaScript executes in the victim user's browser context rather than the admin's. Because the malicious content can only be planted by an already-privileged administrator, the realistic threat is a malicious or compromised admin account, or an admin tricked into pasting attacker-supplied content - this substantially limits mass-exploitation value. No EPSS score, CISA KEV listing, or SSVC decision data was supplied, and no public exploit is referenced, so there is no signal of active or widespread exploitation. The signals are not conflicting; rather, several are simply absent. Note the apparent tension that stored XSS typically requires only limited admin effort yet is gated behind the highest privilege level, which is why the base score stays Medium despite a network vector.

A malicious or compromised OTRS administrator edits a Custom Page and embeds JavaScript into its content, which the application stores. When an agent or customer user subsequently opens that Custom Page, the script executes in their browser under their session, enabling session-context actions such as cookie/token theft or UI manipulation. No public proof-of-concept is referenced; the network attack vector applies only after the admin-planted payload is in place and a victim visits the page.