Is CVE-2026-78359 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-78359 being exploited in the wild.

How severe is CVE-2026-78359?

Medium severity, with a CVSS score of 5.4, published 12 October 2026.

Which products and versions are affected?

Otrs 7.0.x, 8.0.x, 2023.x, 2024.x, 2025.x, 2026.x before 2026.7.x; Community Edition 6.x and earlier.

Is there a fix for CVE-2026-78359?

Yes: fixed in OTRS 2026.7.x and later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-78359 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-78359?

Check whether you run Otrs at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-78359: OTRS insufficient customer user identity uniqueness enforcement

CVE-2026-78359 · Severity: medium · CVSS 5.4 · Published 2026-10-12

OTRS is a service management and ticketing platform used by organizations to manage customer support and IT service requests. A flaw in how OTRS handles multiple customer databases allows an authenticated admin or operator to create duplicate customer records using the same email address across different backends (such as databases and LDAP directories). This could cause customer information or email communications to be routed to the wrong customer account, leading to data exposure or service disruption.

Technologies: Otrs. Vendors: Otrs.

Quick answers

Is CVE-2026-78359 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-78359 being exploited in the wild.
How severe is CVE-2026-78359?: Medium severity, with a CVSS score of 5.4, published 12 October 2026.
Which products and versions are affected?: Otrs 7.0.x, 8.0.x, 2023.x, 2024.x, 2025.x, 2026.x before 2026.7.x; Community Edition 6.x and earlier.
Is there a fix for CVE-2026-78359?: Yes: fixed in OTRS 2026.7.x and later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-78359 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-78359?: Check whether you run Otrs at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: OTRS 2026.7.x and later

Technical details

OTRS fails to enforce email uniqueness constraints when multiple CustomerUser backends are configured; the uniqueness check is performed only within the selected backend rather than globally. An authenticated user with customer user creation/modification permissions can create duplicate customer identities across backends. The vulnerability requires authentication and administrative privilege, and impacts data integrity and customer information isolation depending on backend resolution order.

Affected products

OTRS OTRS 7.0.x, 8.0.x, 2023.x, 2024.x, 2025.x, 2026.x before 2026.7.x; Community Edition 6.x and earlier

Timeline

2026-10-12: disclosed

References

https://otrs.com/release-notes/otrs-security-advisory-2026-16/

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.