Is CVE-2026-48212 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-48212 being exploited in the wild.

How severe is CVE-2026-48212?

Medium severity, with a CVSS score of 4.8, published 12 October 2026.

Which products and versions are affected?

Otrs 7.0.X, 8.0.X, 2023.X, 2024.X, 2025.X, 2026.X before 2026.7.X.

Is there a fix for CVE-2026-48212?

Yes: fixed in OTRS 2026.7.X and later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-48212 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-48212?

Check whether you run Otrs at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-48212: OTRS stored cross-site scripting in Custom Page

CVE-2026-48212 · Severity: medium · CVSS 4.8 · Published 2026-10-12

OTRS is a service management platform used by organizations to manage support tickets and internal IT services. An administrator with privileged access can inject arbitrary JavaScript code into custom pages, which is then executed in the browsers of all users who access those pages. This could allow an attacker with admin access to steal user session tokens, capture credentials, or perform actions on behalf of users.

Technologies: Otrs. Vendors: Otrs.

Quick answers

Is CVE-2026-48212 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-48212 being exploited in the wild.
How severe is CVE-2026-48212?: Medium severity, with a CVSS score of 4.8, published 12 October 2026.
Which products and versions are affected?: Otrs 7.0.X, 8.0.X, 2023.X, 2024.X, 2025.X, 2026.X before 2026.7.X.
Is there a fix for CVE-2026-48212?: Yes: fixed in OTRS 2026.7.X and later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-48212 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-48212?: Check whether you run Otrs at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: OTRS 2026.7.X and later

Technical details

A stored cross-site scripting (XSS) vulnerability exists in OTRS's Custom Page feature where administrator input is not properly sanitized before being stored and rendered. An authenticated administrator can insert malicious JavaScript that persists in the application and executes client-side in users' browsers without additional authentication or user interaction required. The vulnerability affects multiple major versions and requires administrative privileges to exploit.

Affected products

OTRS OTRS 7.0.X, 8.0.X, 2023.X, 2024.X, 2025.X, 2026.X before 2026.7.X

Timeline

2026-10-12: disclosed

References

https://otrs.com/release-notes/otrs-security-advisory-2026-11/

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.