Is CVE-2026-105455 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-105455 being exploited in the wild.

How severe is CVE-2026-105455?

Informational severity, published 30 October 2026.

Which products and versions are affected?

Best Practical Solutions RT for Incident Response 6.0.0 to 6.0.4.

Is there a fix for CVE-2026-105455?

Yes: fixed in 6.0.4. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-105455 attacked?

It is attacked over the network.

Am I affected by CVE-2026-105455?

Check whether you run Best Practical Solutions RT for Incident Response at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-105455: Best Practical Solutions RT for Incident Response reflected XSS in ticket forms

CVE-2026-105455 · Severity: info · Published 2026-10-30

RT for Incident Response (RTIR) is a ticketing system used by incident response and security teams to manage reports and investigations. When splitting a ticket or creating an incident from a report, RTIR displays the related ticket's subject in the form without sanitizing HTML, allowing malicious scripts embedded in ticket subjects to execute in the browser. An unauthenticated attacker can send an incident report with a script-containing subject, which will execute with the privileges of any incident handler who opens the form.

Vendors: Best Practical Solutions.

Quick answers

Is CVE-2026-105455 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-105455 being exploited in the wild.
How severe is CVE-2026-105455?: Informational severity, published 30 October 2026.
Which products and versions are affected?: Best Practical Solutions RT for Incident Response 6.0.0 to 6.0.4.
Is there a fix for CVE-2026-105455?: Yes: fixed in 6.0.4. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-105455 attacked?: It is attacked over the network.
Am I affected by CVE-2026-105455?: Check whether you run Best Practical Solutions RT for Incident Response at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 6.0.4

Technical details

Improper output encoding (CWE-79) of ticket subject fields in RTIR's ticket creation and splitting forms allows reflected cross-site scripting (XSS). An unauthenticated attacker can craft an Incident Report with malicious JavaScript in the subject field, which executes in the session context of incident handlers who open the split or create-from-report form. The vulnerability exists because RTIR permits unauthenticated users to create Incident Reports by default and does not HTML-escape the displayed subject before rendering it in the form.

Affected products

Best Practical Solutions RT for Incident Response 6.0.0 to 6.0.4

Timeline

2026-10-30: disclosed
2026-10-30: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.