Is CVE-2026-44228 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-44228 being exploited in the wild.

How severe is CVE-2026-44228?

Medium severity, with a CVSS score of 5.4, published 20 July 2026.

Which products and versions are affected?

Best Practical Solutions RT >= 6.0.0, < 6.0.3.

Is there a fix for CVE-2026-44228?

A patch was published on 2026-05-20: RT version 6.0.3 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-44228 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-44228?

Check whether you run Best Practical Solutions RT at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-44228: Best Practical RT stored XSS via insufficient template escaping

Q: Is there a fix for CVE-2026-44228?

A patch was published on 2026-05-20: RT version 6.0.3 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-44228 attacked?

It is attacked over the network, in a network appliance.

Q: Am I affected by CVE-2026-44228?

Check whether you run Best Practical Solutions RT at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-44228 · Severity: medium · CVSS 5.4 · Published 2026-07-20

Request Tracker (RT), an enterprise-grade ticket tracking system, contains a vulnerability that allows users to inject malicious scripts into the platform. An authenticated user could save specially crafted data that, when viewed by another staff member or administrator, executes unauthorized code in their browser. This could lead to the theft of session information or unauthorized actions being performed on behalf of the victim.

Technologies: Best Practical Solutions RT. Vendors: Best Practical Solutions.

Quick answers

Is CVE-2026-44228 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-44228 being exploited in the wild.
How severe is CVE-2026-44228?: Medium severity, with a CVSS score of 5.4, published 20 July 2026.
Which products and versions are affected?: Best Practical Solutions RT >= 6.0.0, < 6.0.3.
Is there a fix for CVE-2026-44228?: A patch was published on 2026-05-20: RT version 6.0.3 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-44228 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-44228?: Check whether you run Best Practical Solutions RT at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A stored Cross-Site Scripting (XSS) vulnerability exists in RT 6.0.x due to improper neutralization of user-controllable input during web page generation (CWE-79). Specifically, user-controlled data is rendered within templates without proper HTML escaping. An authenticated attacker with permissions to modify ticket data or other relevant fields can inject a JavaScript payload. This payload is then executed in the context of any user (including administrators) who navigates to the affected page. The vulnerability is addressed in version 6.0.3 by implementing proper output encoding.

Affected products

Best Practical RT >= 6.0.0, < 6.0.3

Timeline

2026-05-20: patched: RT version 6.0.3 released
2026-05-20: advisory: GitHub Security Advisory published
2026-07-20: disclosed: NVD publication date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.