These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
CVE-2026-93582 is a critical authentication bypass vulnerability in ((OTRS)) Community Edition 6 and prior versions. An unauthenticated remote attacker can supply a crafted Remote-User request header to impersonate existing agent or customer users without knowing their credentials, potentially gaining access to confidential information and modification of data or configuration.
CVE-2026-93581 Insufficient Neutralization of Formula Elements in CSV Exports. User-controlled values are not sufficiently neutralized when included in CSV exports, allowing attackers to inject malicious formulas. This medium-severity vulnerability affects OTRS, potentially leading to unintended actions or information disclosure in spreadsheet applications. OTRS administrators and users should prioritize [truncated]
OTRS has a vulnerability allowing duplicate customer user identities across multiple backends. This issue enables an authenticated user to create a customer user with an email address already in use by another customer user in a different backend. The vulnerability affects OTRS versions 7.0.X, 8.0.X, 2023.X, 2024.X, 2025.X, and 2026.X before 2026.7.X. ((OTRS)) Community Edition 6.x and earlier are also vu [truncated]
A Cross-Site Request Forgery (CSRF) vulnerability exists in several administrative actions of OTRS, particularly in the DBUpdateLogCleanUp action. This action can be triggered via a GET request without validating a ChallengeToken, allowing an unauthenticated remote attacker to execute the cleanup action by embedding a crafted request in a malicious web page. Successful exploitation can delete existing DBU [truncated]
CVE-2026-78357 Insufficient Session Revocation for JWT Authentication. The vulnerability allows an attacker with a valid JWT authentication token to maintain access to OTRS even after the associated account is deactivated or the password is changed. This critical issue affects OTRS versions 7.0.X, 8.0.X, 2023.X, 2024.X, 2025.X, and 2026.X before 2026.7.X, impacting OTRS administrators, security teams, and [truncated]
CVE-2026-78356 is a vulnerability in OTRS that allows unauthenticated remote users to retrieve internal application configuration intended for the authenticated Agent Frontend. The exposed information may include configured frontend routes, authorization groups, authentication configuration, and other implementation details. This issue affects OTRS versions 8.0.X, 2023.X, 2024.X, 2025.X, and 2026.X before 2026.7.X.
A path traversal vulnerability in OTRS' SendSupportBundle functionality allows an authenticated administrator to delete files outside the intended directory, within the effective permissions of the OTRS application process. This issue affects multiple OTRS versions, including 7.0.X, 8.0.X, and various release branches up to 2026. The vulnerability may allow files accessible to the OTRS application process [truncated]
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-10-12T06:48:50.387Z and has not been modified since then. This stored XSS vulnerability in OTRS Custom Pages allows administrators to enter arbitrary JavaScript, which is executed in users' browsers. OTRS administrators, users accessing custom pages, and security teams should verify their exposure and [truncated]
An authenticated administrator can be induced to delete administrative Import/Export templates through a Cross-Site Request Forgery (CSRF) attack. The OTRS AdminImportExport::TemplateDelete action does not validate the request's ChallengeToken, allowing an unauthenticated remote attacker to craft a malicious request that is executed with the privileges of an active administrator session.