Is CVE-2026-93581 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-93581 being exploited in the wild.

How severe is CVE-2026-93581?

Medium severity, with a CVSS score of 6.1, published 12 October 2026.

Which products and versions are affected?

Otrs 7.0.x, 8.0.x, 2023.x, 2024.x, 2025.x, 2026.x before 2026.7.x, Community Edition 6.x and earlier.

Is there a fix for CVE-2026-93581?

Yes: fixed in OTRS 2026.7.x and later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-93581 attacked?

It is attacked over the network.

Am I affected by CVE-2026-93581?

Check whether you run Otrs at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-93581: OTRS CSV injection via formula characters in user-controlled values

CVE-2026-93581 · Severity: medium · CVSS 6.1 · Published 2026-10-12

OTRS is a service management platform used to handle customer support tickets and IT operations. When administrators or users export data to CSV files, values submitted by attackers through external channels like email or user input can contain spreadsheet formula characters (=, +, -, @) that are not neutralized. When these exported CSV files are opened in spreadsheet applications, the formulas may execute, potentially causing information disclosure, unintended actions, or triggering external functionality depending on the spreadsheet software's configuration.

Technologies: Otrs. Vendors: Otrs.

Quick answers

Is CVE-2026-93581 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-93581 being exploited in the wild.
How severe is CVE-2026-93581?: Medium severity, with a CVSS score of 6.1, published 12 October 2026.
Which products and versions are affected?: Otrs 7.0.x, 8.0.x, 2023.x, 2024.x, 2025.x, 2026.x before 2026.7.x, Community Edition 6.x and earlier.
Is there a fix for CVE-2026-93581?: Yes: fixed in OTRS 2026.7.x and later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-93581 attacked?: It is attacked over the network.
Am I affected by CVE-2026-93581?: Check whether you run Otrs at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: OTRS 2026.7.x and later

Technical details

This is a CSV injection vulnerability where user-controlled input is not properly escaped when exported to CSV format. An attacker can inject values starting with formula metacharacters (=, +, -, @) through external input channels like incoming emails or user submissions without requiring authentication. When the CSV is opened in spreadsheet software, these values may be interpreted as formulas rather than literal text, allowing formula execution in the context of the spreadsheet application. A fix is available in OTRS 2026.7.x and later versions.

Affected products

OTRS OTRS 7.0.x, 8.0.x, 2023.x, 2024.x, 2025.x, 2026.x before 2026.7.x, Community Edition 6.x and earlier

Timeline

2026-10-12: disclosed

References

https://otrs.com/release-notes/otrs-security-advisory-2026-17/

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.