Is CVE-2026-38444 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-38444 being exploited in the wild.

How severe is CVE-2026-38444?

Medium severity, with a CVSS score of 6.1, published 3 August 2026.

Which products and versions are affected?

Enhancesoft LLC osTicket 1.18.3 and earlier.

Is there a fix for CVE-2026-38444?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-38444 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-38444?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-38444: osTicket stored cross-site scripting in email From-header display name

CVE-2026-38444 · Severity: medium · CVSS 6.1 · Published 2026-08-03

osTicket is a help-desk ticketing system used to manage customer support requests. A flaw in how osTicket processes reply emails allows an unauthenticated attacker to inject malicious JavaScript code via the sender's display name, which is then stored and executed in the browsers of staff and customers viewing the affected ticket. This can lead to session hijacking, unauthorized ticket actions, and exposure of sensitive customer data.

Quick answers

Is CVE-2026-38444 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-38444 being exploited in the wild.
How severe is CVE-2026-38444?: Medium severity, with a CVSS score of 6.1, published 3 August 2026.
Which products and versions are affected?: Enhancesoft LLC osTicket 1.18.3 and earlier.
Is there a fix for CVE-2026-38444?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-38444 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-38444?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a stored cross-site scripting (XSS) flaw in osTicket's email processing pipeline. When osTicket receives an inbound reply to an existing ticket (via Thread::postEmail() in include/class.mailparse.php), the sender's display name from the RFC 2822 From header is extracted without HTML sanitization and stored directly in the poster column of the ost_thread_entry database table. The vulnerability manifests only when the sender's email address is unregistered in the system, causing the template layer to output the raw poster value without encoding in staff views, client portal views, preview panes, and ticket export pages. An unauthenticated attacker can exploit this by sending a crafted reply email with a valid In-Reply-To header and an XSS payload embedded in the From display name (e.g., "<img src=x onerror=alert(document.cookie)>"). The payload executes persistently in any staff member's or end user's browser upon ticket access. The root cause is missing input sanitization in ThreadEntry::add() and output encoding in multiple template files; a similar title field in the same function receives Format::sanitize(), but the poster field was omitted. As of publication, no patch has been released.

Affected products

Enhancesoft LLC osTicket 1.18.3 and earlier

Timeline

2026-08-03: disclosed: CVE-2026-38444 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.