Is CVE-2026-93483 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-93483 being exploited in the wild.

How severe is CVE-2026-93483?

Informational severity, published 15 October 2026.

Which products and versions are affected?

Znuny 6.0, 6.1, 6.2, 6.3, 6.4, 7.0, 7.1, 7.2, and 7.3.1 through 7.3.6; Znuny LTS 6.5.1 through 6.5.24.

Is there a fix for CVE-2026-93483?

Yes: fixed in Znuny 7.3.7, Znuny LTS 6.5.25. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-93483 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-93483?

Check whether you run Znuny or Znuny LTS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-93483: Znuny HTTPBasicAuth header spoofing authentication bypass

CVE-2026-93483 · Severity: info · Published 2026-10-15

Znuny is a ticket management and helpdesk system used by organizations to track support requests and customer interactions. An attacker can gain unauthorized access to any user account, including administrator accounts, by forging a single HTTP request header, without needing a password. This allows an attacker to impersonate users, access confidential support tickets, and modify system settings.

Technologies: Znuny, Znuny LTS. Vendors: Znuny.

Quick answers

Is CVE-2026-93483 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-93483 being exploited in the wild.
How severe is CVE-2026-93483?: Informational severity, published 15 October 2026.
Which products and versions are affected?: Znuny 6.0, 6.1, 6.2, 6.3, 6.4, 7.0, 7.1, 7.2, and 7.3.1 through 7.3.6; Znuny LTS 6.5.1 through 6.5.24.
Is there a fix for CVE-2026-93483?: Yes: fixed in Znuny 7.3.7, Znuny LTS 6.5.25. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-93483 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-93483?: Check whether you run Znuny or Znuny LTS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: Znuny 7.3.7, Znuny LTS 6.5.25

Technical details

The HTTPBasicAuth authentication modules (for both agent and customer interfaces) trust the HTTP_REMOTE_USER header as a fallback for the username when the primary $ENV{REMOTE_USER} variable is unavailable. An attacker can forge the "Remote-User" request header to impersonate any existing user on systems configured to use HTTPBasicAuth for authentication. This is a header spoofing vulnerability requiring only network access and no user interaction or credentials.

Affected products

Znuny Znuny 6.0, 6.1, 6.2, 6.3, 6.4, 7.0, 7.1, 7.2, and 7.3.1 through 7.3.6
Znuny Znuny LTS 6.5.1 through 6.5.24

Timeline

2026-09-16: advisory
2026-10-15: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.