Is CVE-2026-26895 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-26895 being exploited in the wild.

How severe is CVE-2026-26895?

Medium severity, with a CVSS score of 5.3, published 2 April 2026.

Which products and versions are affected?

Enhancesoft osTicket Up to (excluding) 1.18.3.

Is there a fix for CVE-2026-26895?

A patch was published on 2026-01-15: Vendor released version 1.18.3 and commit d832f24 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-26895 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-26895?

Check whether you run Enhancesoft osTicket at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-26895: osTicket user enumeration via timing side-channel in pwreset.php

CVE-2026-26895 · Severity: medium · CVSS 5.3 · Published 2026-04-02

osTicket, a popular open-source customer support and IT ticketing platform, is affected by a security flaw in its password reset process. An attacker can determine which email addresses or usernames are registered on the system by measuring how long the server takes to respond to reset requests. This information can be used to build a list of valid targets for more serious attacks, such as phishing, account takeovers, or credential stuffing.

Technologies: Enhancesoft osTicket. Vendors: Enhancesoft.

Quick answers

Is CVE-2026-26895 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-26895 being exploited in the wild.
How severe is CVE-2026-26895?: Medium severity, with a CVSS score of 5.3, published 2 April 2026.
Which products and versions are affected?: Enhancesoft osTicket Up to (excluding) 1.18.3.
Is there a fix for CVE-2026-26895?: A patch was published on 2026-01-15: Vendor released version 1.18.3 and commit d832f24 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-26895 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-26895?: Check whether you run Enhancesoft osTicket at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A timing side-channel vulnerability exists in the `/pwreset.php` endpoint of osTicket versions prior to 1.18.3. When SMTP is configured, the application exhibits a measurable discrepancy in response times: valid usernames trigger an SMTP email dispatch (taking several seconds), while invalid usernames return an error immediately (under one second). An unauthenticated remote attacker can use automated tools like Burp Suite Intruder to perform a timing attack and enumerate valid accounts. The vulnerability was addressed in version 1.18.3 by implementing a minimum response threshold of 1.4 seconds with added random jitter to normalize response times.

Affected products

EnhanceSoft osTicket Up to (excluding) 1.18.3

Timeline

2026-01-15: disclosed: Vulnerability reported to vendor
2026-01-15: patched: Vendor released version 1.18.3 and commit d832f24
2026-04-02: advisory: NVD publication date

References

https://csacyber.com/blog/osticket-timing-vulnerability-understanding-the-risk

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.