Is CVE-2026-48211 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-48211 being exploited in the wild.

How severe is CVE-2026-48211?

Medium severity, with a CVSS score of 5.4, published 12 October 2026.

Which products and versions are affected?

OTRS Community Edition 6.x and earlier, 7.0.x, 8.0.x, 2023.x, 2024.x, 2025.x, and 2026.x before 2026.7.

Is there a fix for CVE-2026-48211?

Yes: fixed in OTRS 2026.7 and later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-48211 attacked?

It is attacked over the network.

Am I affected by CVE-2026-48211?

Check whether you run OTRS Community Edition at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-48211: OTRS Cross-Site Request Forgery in AdminImportExport template deletion

CVE-2026-48211 · Severity: medium · CVSS 5.4 · Published 2026-10-12

OTRS is a service management and ticketing platform used by organizations to handle IT support requests and customer service. An attacker can trick an authenticated administrator into deleting import/export templates by crafting a malicious webpage that exploits the administrator's active session, leading to loss of administrative configuration data.

Technologies: OTRS Community Edition. Vendors: Otrs.

Quick answers

Is CVE-2026-48211 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-48211 being exploited in the wild.
How severe is CVE-2026-48211?: Medium severity, with a CVSS score of 5.4, published 12 October 2026.
Which products and versions are affected?: OTRS Community Edition 6.x and earlier, 7.0.x, 8.0.x, 2023.x, 2024.x, 2025.x, and 2026.x before 2026.7.
Is there a fix for CVE-2026-48211?: Yes: fixed in OTRS 2026.7 and later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-48211 attacked?: It is attacked over the network.
Am I affected by CVE-2026-48211?: Check whether you run OTRS Community Edition at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: OTRS 2026.7 and later

Technical details

The AdminImportExport::TemplateDelete action in OTRS fails to validate the ChallengeToken, allowing CSRF attacks. An unauthenticated remote attacker can craft a malicious cross-site request that, when executed in the browser of an authenticated administrator, deletes administrative Import/Export templates without authorization. The vulnerability requires user interaction (the administrator must visit a malicious site while logged in) but requires no authentication from the attacker.

Affected products

OTRS OTRS Community Edition 6.x and earlier, 7.0.x, 8.0.x, 2023.x, 2024.x, 2025.x, and 2026.x before 2026.7

Timeline

2026-10-12: disclosed

References

https://otrs.com/release-notes/otrs-security-advisory-2026-10/

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.