Is CVE-2026-36214 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-36214 being exploited in the wild.

How severe is CVE-2026-36214?

Informational severity, with a CVSS score of 0, published 14 July 2026.

Which products and versions are affected?

Enhancesoft osTicket 1.10 to 1.17.7, 1.18.0 to 1.18.3.

Is there a fix for CVE-2026-36214?

A patch was published on 2026-06-17: Fixes released in v1.17.8 and v1.18.4 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-36214 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-36214?

Check whether you run Enhancesoft osTicket at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-36214: osTicket stored XSS in Bootstrap Tooltip component

CVE-2026-36214 · Severity: info · CVSS 0 · Published 2026-07-14

osTicket, a popular open-source customer support platform, is affected by a security flaw that allows attackers to inject malicious scripts into support tickets. When a helpdesk agent or administrator views these tickets, the script executes in their browser, potentially allowing the attacker to take over their session, access sensitive customer data, or modify system configurations. This vulnerability stems from an outdated third-party component and insufficient filtering of user-submitted content.

Technologies: Enhancesoft osTicket. Vendors: Enhancesoft.

Quick answers

Is CVE-2026-36214 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-36214 being exploited in the wild.
How severe is CVE-2026-36214?: Informational severity, with a CVSS score of 0, published 14 July 2026.
Which products and versions are affected?: Enhancesoft osTicket 1.10 to 1.17.7, 1.18.0 to 1.18.3.
Is there a fix for CVE-2026-36214?: A patch was published on 2026-06-17: Fixes released in v1.17.8 and v1.18.4 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-36214 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-36214?: Check whether you run Enhancesoft osTicket at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

osTicket is vulnerable to stored Cross-Site Scripting (XSS) because it includes a known-vulnerable version of Bootstrap Tooltip (3.3.4, affected by CVE-2019-8331). The application's HTML sanitization (htmlLawed) fails to block malicious 'data-template' attributes used by the tooltip component. An unauthenticated remote attacker can submit a ticket containing a crafted HTML payload that triggers JavaScript execution when viewed by an authenticated Agent or Admin. The impact is heightened by the fact that osTicket serves user-uploaded JavaScript files with a 'text/javascript' Content-Type, allowing attackers to bypass inline script limitations by referencing uploaded malicious scripts. The issue is fixed in versions 1.17.8 and 1.18.4.

Affected products

Enhancesoft osTicket 1.10 to 1.17.7, 1.18.0 to 1.18.3

Timeline

2026-06-17: patched: Fixes released in v1.17.8 and v1.18.4
2026-07-14: disclosed: CVE-2026-36214 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.