Is CVE-2026-41075 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-41075 being exploited in the wild.

How severe is CVE-2026-41075?

High severity, with a CVSS score of 8.8, published 22 May 2026.

Which products and versions are affected?

Best Practical Solutions Request Tracker 5.0.0 to 5.0.9, 6.0.0 to 6.0.2.

Is there a fix for CVE-2026-41075?

A patch was published on 2026-05-20: Versions 5.0.10 and 6.0.3 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-41075 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-41075?

Check whether you run Best Practical Solutions Request Tracker at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-41075: Best Practical RT SQL injection in JSON search entry_aggregator

CVE-2026-41075 · Severity: high · CVSS 8.8 · Published 2026-05-22

Best Practical RT, an enterprise-grade ticket and issue tracking system, is vulnerable to a security flaw that could allow an authorized user to access or modify sensitive database information. By submitting specially crafted search requests, a user with a standard account could bypass security controls to view or change data they should not have access to. This could lead to the exposure of confidential support tickets, customer data, or the unauthorized modification of system records.

Technologies: Best Practical Solutions Request Tracker. Vendors: Best Practical Solutions.

Quick answers

Is CVE-2026-41075 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-41075 being exploited in the wild.
How severe is CVE-2026-41075?: High severity, with a CVSS score of 8.8, published 22 May 2026.
Which products and versions are affected?: Best Practical Solutions Request Tracker 5.0.0 to 5.0.9, 6.0.0 to 6.0.2.
Is there a fix for CVE-2026-41075?: A patch was published on 2026-05-20: Versions 5.0.10 and 6.0.3 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-41075 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-41075?: Check whether you run Best Practical Solutions Request Tracker at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An SQL injection vulnerability exists in Best Practical RT versions 5.0.x (before 5.0.10) and 6.0.x (before 6.0.3). The flaw is located in the 'entry_aggregator' parameter within the JSON search functionality. An authenticated attacker can provide unvalidated input that is directly incorporated into database queries. This allows for the execution of arbitrary SQL commands, potentially leading to full database compromise, including the ability to read, modify, or delete data. The vulnerability is reachable over the network but requires at least low-level user authentication. Patches are available in versions 5.0.10 and 6.0.3.

Affected products

Best Practical RT (Request Tracker) 5.0.0 to 5.0.9, 6.0.0 to 6.0.2

Timeline

2026-05-20: patched: Versions 5.0.10 and 6.0.3 released
2026-05-20: advisory: GitHub Security Advisory published
2026-05-22: disclosed: CVE published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.