PatchSiren cyber security CVE debrief

CVE-2026-9507 Enhancesoft CVE debrief

A session fixation vulnerability has been identified in osTicket v1.18.2. This security flaw allows an attacker to hijack a victim's account by keeping the initial session identifier (OSTSESSID) active after a successful login. The issue lies in the fact that the application does not invalidate the pre-authentication cookie or generate a new identifier for the authenticated context. As a result, if an attacker manages to set a known session identifier in the victim's browser, they will be able to maintain unauthorized access to the account once the victim has authenticated.

Vendor: Enhancesoft
Product: osTicket
CVSS: MEDIUM 5.1
CISA KEV: Not listed in stored evidence
Original CVE published: 2026-06-16
Original CVE updated: 2026-06-16
Advisory published: 2026-06-16
Advisory updated: 2026-06-16

Who should care

Users of osTicket v1.18.2

Technical summary

The vulnerability has a CVSS score of 5.1 and is classified as MEDIUM severity. The CVE record can be found at [cve-org]. More details are available at [nvd].

Defensive priority

MEDIUM

Recommended defensive actions

Update to a patched version of osTicket
Invalidate pre-authentication cookies after login
Generate new session identifiers for authenticated contexts

Evidence notes

The vulnerability was reported by Incibe. More information can be found at [ref-4].

Sources and references

Verified primary and authoritative sources

CVE-2026-9507 CVE Program record
Publisher, destination, and source semantics verified

URL: https://www.cve.org/CVERecord?id=CVE-2026-9507

CVE Program - Official CVE Program record with source-provided CVE metadata.
CVE-2026-9507 NVD vulnerability detail
Publisher, destination, and source semantics verified

URL: https://nvd.nist.gov/vuln/detail/CVE-2026-9507

NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Source reference
Unverified legacy reference

URL: https://www.incibe.es/en/incibe-cert/notices/aviso/session-fixation-vulnerability-enhancesofts-osticket

[email protected]

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.