PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-48188 OTRS AG CVE debrief

An improper input validation vulnerability in the OTRS database layer module enables unauthenticated SQL injection, which can lead to authentication bypass. The issue is only exploitable when the backend MySQL or MariaDB server is configured with the NO_BACKSLASH_ESCAPES SQL mode. Affected versions include OTRS 7.0.X, 8.0.X, 2023.X, 2024.X, 2025.X, and 2026.X before 2026.4.X, as well as ((OTRS)) Community Edition 6.0.x. Products derived from the ((OTRS)) Community Edition are also likely affected. The vulnerability carries a CVSS 3.1 score of 9.1 (Critical).

Vendor
OTRS AG
Product
OTRS
CVSS
CRITICAL 9.1
CISA KEV
Not listed in stored evidence
Original CVE published
2026-06-01
Original CVE updated
2026-06-01
Advisory published
2026-06-01
Advisory updated
2026-06-01

Who should care

Organizations running OTRS or ((OTRS)) Community Edition for IT service management, help desk, or customer support operations, particularly those using MySQL or MariaDB with non-default SQL modes.

Technical summary

The vulnerability exists in the OTRS database layer module due to improper input validation. An unauthenticated attacker can inject SQL payloads, achieving authentication bypass. Exploitation is contingent on the database server operating with NO_BACKSLASH_ESCAPES enabled, which alters how backslash characters are handled in string escaping. The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N, reflecting network attackability, low complexity, no privileges required, no user interaction, and high impact to confidentiality and integrity with no availability impact.

Defensive priority

Critical

Recommended defensive actions

  • Verify whether your OTRS or ((OTRS)) Community Edition instance is running an affected version.
  • Check the MySQL or MariaDB server configuration for the NO_BACKSLASH_ESCAPES SQL mode; if enabled, prioritize patching or mitigation.
  • Apply the relevant OTRS security update as indicated in the vendor security advisory.
  • If immediate patching is not feasible, consider disabling NO_BACKSLASH_ESCAPES on the database server after assessing application compatibility, or restrict network access to the OTRS application.
  • Monitor authentication logs for anomalous activity that may indicate exploitation attempts.
  • Review any products based on ((OTRS)) Community Edition for susceptibility to this vulnerability.

Evidence notes

The vulnerability description and affected versions are drawn from the official CVE record and the OTRS security advisory reference. The CVSS vector and score are sourced from NVD metadata. The vendor attribution to OTRS is based on the reference domain candidate and the explicit security advisory link.

Official resources

2026-06-01