Is CVE-2026-78358 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-78358 being exploited in the wild.

How severe is CVE-2026-78358?

Medium severity, with a CVSS score of 4.3, published 12 October 2026.

Which products and versions are affected?

Otrs Community Edition 6.x and before; Otrs 7.0.x, 8.0.x, 2023.x, 2024.x, 2025.x, 2026.x before 2026.7.x, and 6.x Community Edition.

Is there a fix for CVE-2026-78358?

Yes: fixed in 2026.7.x and later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-78358 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-78358?

Check whether you run Otrs Community Edition or Otrs at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-78358: OTRS cross-site request forgery in administrative actions

CVE-2026-78358 · Severity: medium · CVSS 4.3 · Published 2026-10-12

OTRS is a ticketing and issue tracking system used by organizations to manage customer requests. Attackers can trick authenticated OTRS administrators into performing unintended actions—such as deleting log entries or synchronizing configurations—by luring them to a malicious website, with no additional confirmation required. While the direct damage is limited, this could impair an organization's ability to audit and troubleshoot system issues.

Technologies: Otrs Community Edition, Otrs. Vendors: Otrs.

Quick answers

Is CVE-2026-78358 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-78358 being exploited in the wild.
How severe is CVE-2026-78358?: Medium severity, with a CVSS score of 4.3, published 12 October 2026.
Which products and versions are affected?: Otrs Community Edition 6.x and before; Otrs 7.0.x, 8.0.x, 2023.x, 2024.x, 2025.x, 2026.x before 2026.7.x, and 6.x Community Edition.
Is there a fix for CVE-2026-78358?: Yes: fixed in 2026.7.x and later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-78358 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-78358?: Check whether you run Otrs Community Edition or Otrs at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 2026.7.x and later

Technical details

Multiple administrative endpoints in OTRS lack CSRF token (ChallengeToken) validation, allowing cross-site request forgery attacks. The DBUpdateLogCleanUp action is triggerable via GET requests by unauthenticated attackers targeting authenticated administrators; other endpoints can deploy or synchronize configurations without proper request origin validation. Export and read-only endpoints also lack tokens but are protected by browser same-origin policy, limiting exposure.

Affected products

OTRS OTRS 7.0.x, 8.0.x, 2023.x, 2024.x, 2025.x, 2026.x before 2026.7.x, and 6.x Community Edition
OTRS Community Edition 6.x and before

Timeline

2026-10-12: disclosed

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.