Is CVE-2026-6841 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-6841 being exploited in the wild.

How severe is CVE-2026-6841?

Informational severity, with a CVSS score of 5.1, published 21 May 2026.

Which products and versions are affected?

Best Practical Solutions Request Tracker 5.0.4 to 5.0.9, 6.0.0 to 6.0.2.

Is there a fix for CVE-2026-6841?

A patch was published on 2026-05-20: Fixed in versions 5.0.10 and 6.0.3 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-6841 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-6841?

Check whether you run Best Practical Solutions Request Tracker at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-6841: Best Practical Request Tracker reflected XSS in Page parameter

CVE-2026-6841 · Severity: info · CVSS 5.1 · Published 2026-05-21

Best Practical Request Tracker, a popular open-source ticketing and workflow management system, is vulnerable to a security flaw that could allow an attacker to execute malicious scripts in a user's browser. By tricking a logged-in user into clicking a specially crafted link, an attacker could potentially steal session information or perform actions on the user's behalf. This could lead to unauthorized access to sensitive support tickets or administrative functions.

Technologies: Best Practical Solutions Request Tracker. Vendors: Best Practical Solutions.

Quick answers

Is CVE-2026-6841 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-6841 being exploited in the wild.
How severe is CVE-2026-6841?: Informational severity, with a CVSS score of 5.1, published 21 May 2026.
Which products and versions are affected?: Best Practical Solutions Request Tracker 5.0.4 to 5.0.9, 6.0.0 to 6.0.2.
Is there a fix for CVE-2026-6841?: A patch was published on 2026-05-20: Fixed in versions 5.0.10 and 6.0.3 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-6841 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-6841?: Check whether you run Best Practical Solutions Request Tracker at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A reflected cross-site scripting (XSS) vulnerability exists in Best Practical Request Tracker (RT) versions 5.0.4 through 5.0.9 and 6.0.0 through 6.0.2. The vulnerability is located in the 'Page' URL parameter used during search operations. An unauthenticated remote attacker can exploit this by crafting a malicious URL containing a JavaScript payload and inducing a victim (such as an agent or administrator) to visit the link. Upon interaction, the payload executes within the context of the victim's active session, potentially allowing for session hijacking or unauthorized state-changing actions. The issue is resolved in versions 5.0.10 and 6.0.3.

Affected products

Best Practical Request Tracker 5.0.4 to 5.0.9, 6.0.0 to 6.0.2

Timeline

2026-05-20: patched: Fixed in versions 5.0.10 and 6.0.3
2026-05-21: disclosed: Vulnerability disclosed by CERT Polska
2026-05-21: advisory: NVD publication date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.