How many OTRS GmbH (former OTRS AG) OTRS CVEs are in CISA KEV?

None of OTRS GmbH (former OTRS AG) OTRS's CVEs are currently listed in CISA's Known Exploited Vulnerabilities catalog.

Which versions of OTRS GmbH (former OTRS AG) OTRS are affected?

18 distinct OTRS GmbH (former OTRS AG) OTRS versions are named across its CVEs. Use the version filter above to see the CVEs affecting a specific version.

What are the most common weakness types in OTRS GmbH (former OTRS AG) OTRS CVEs?

OTRS GmbH (former OTRS AG) OTRS's CVEs most often map to these CWE weakness types: CWE-352 (Cross-Site Request Forgery (CSRF)), CWE-22 (Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')), CWE-290 (Authentication Bypass by Spoofing), CWE-497 (Exposure of Sensitive System Information to an Unauthorized Control Sphere).

How many critical OTRS GmbH (former OTRS AG) OTRS vulnerabilities are there?

OTRS GmbH (former OTRS AG) OTRS has 2 critical and 1 high-severity CVEs.

What is the average severity of OTRS GmbH (former OTRS AG) OTRS CVEs?

The average CVSS base score across OTRS GmbH (former OTRS AG) OTRS's scored CVEs is 6.5.

RadicalNotion.AI

Log in Create an account

OTRS GmbH (former OTRS AG)

9 CVEs

OTRS GmbH (former OTRS AG) OTRS Vulnerabilities

Name: OTRS GmbH (former OTRS AG) OTRS vulnerability dataset (CVEs)
Creator: RadicalNotion.AI
License: https://creativecommons.org/licenses/by-nc/4.0/

CVE security advisories and vulnerability history for OTRS by OTRS GmbH (former OTRS AG).

9

Total CVEs

Published

0

In CISA KEV

Exploited in the wild

0

Public exploits

PoC or exploit code

6.5

Avg CVSS

2026–2026

Last updated October 12, 2026

Overview

OTRS GmbH (former OTRS AG) OTRS has 9 published CVE records since 2026, of which 0 are in CISA's Known Exploited Vulnerabilities catalog and 0 have a known public exploit. The average CVSS base score across scored CVEs is 6.5.

Severity and exploitation

How the CVSS severity of OTRS GmbH (former OTRS AG) OTRS's CVEs breaks down, plus how many are exploited in the wild or have public exploit code.

Critical2

High1

Medium6

Low0

In CISA’s Known Exploited Vulnerabilities catalog

0

None of OTRS GmbH (former OTRS AG) OTRS's CVEs are currently listed in CISA's KEV catalog.

Public exploits

0

No OTRS GmbH (former OTRS AG) OTRS CVEs currently have a tracked public exploit.

Affected versions and CVEs

Browse every OTRS GmbH (former OTRS AG) OTRS version named in a CVE, then pick one to see only the CVEs that affect it.

Specific versions

2023.x8 CVEs
2024.x8 CVEs
2025.x8 CVEs
8.0.x8 CVEs
7.0.x7 CVEs

Version ranges

2026.x <= v <= 2026.6.x8 CVEs
>= 2023.x1 CVE
>= 2024.x1 CVE
>= 2025.x1 CVE
>= 2026.x1 CVE
>= 7.0.x1 CVE
>= 8.0.x1 CVE

Fixed in

2023.x1 CVE
2024.x1 CVE
2025.x1 CVE
2026.x1 CVE
7.0.x1 CVE
8.0.x1 CVE

Find a version

9 CVEs

Sort

Authentication Bypass via Spoofed Remote-User Header in HTTP Basic Authentication
CVE-2026-93582
Patch
CWE-290
Critical · CVSS 9.4
EPSS 0.4% (32th pct)2026-10-12
Insufficient Neutralization of Formula Elements in CSV Exports
CVE-2026-93581
Patch
CWE-1236
Medium · CVSS 6.1
EPSS 0.2% (8th pct)2026-10-12
Duplicate Identity / Identity Shadowing across CustomerUser backends
CVE-2026-78359
Patch
CWE-694
Medium · CVSS 5.4
EPSS 0.2% (5th pct)2026-10-12
Cross-Site Request Forgery in Administrative Actions
CVE-2026-78358
Patch
CWE-352
Medium · CVSS 4.3
EPSS 0.1% (3th pct)2026-10-12
Insufficient Session Revocation for JWT Authentication
CVE-2026-78357
Patch
CWE-613
Critical · CVSS 9.1
EPSS 0.3% (22th pct)2026-10-12
Unauthenticated Disclosure of Agent Frontend Configuration
CVE-2026-78356
Patch
CWE-497
Medium · CVSS 5.3
EPSS 0.3% (19th pct)2026-10-12
Path Traversal in SendSupportBundle allows File Deletion Outside the Intended Directory
CVE-2026-78355
Patch
CWE-22
High · CVSS 8.7
EPSS 0.7% (53th pct)2026-10-12
Stored XSS in external pages
CVE-2026-48212
Patch
CWE-79
Medium · CVSS 4.8
EPSS 0.1% (3th pct)2026-10-12
Cross-Site Request Forgery in Import/Export Admin console
CVE-2026-48211
Patch
CWE-352
Medium · CVSS 5.4
EPSS 0.1% (2th pct)2026-10-12

Common weakness types

The CWE weakness categories most often found in OTRS GmbH (former OTRS AG) OTRS CVEs. Follow any weakness for its full explanation.

Other OTRS GmbH (former OTRS AG) products

Browse vulnerabilities for other products by OTRS GmbH (former OTRS AG).

((OTRS)) Community Edition6 CVEs

All OTRS GmbH (former OTRS AG) vulnerabilities

Frequently asked questions

Common questions about OTRS GmbH (former OTRS AG) OTRS vulnerabilities.

How many CVEs does OTRS GmbH (former OTRS AG) OTRS have?: OTRS GmbH (former OTRS AG) OTRS has 9 published CVE records since 2026.
How many OTRS GmbH (former OTRS AG) OTRS CVEs are in CISA KEV?: None of OTRS GmbH (former OTRS AG) OTRS's CVEs are currently listed in CISA's Known Exploited Vulnerabilities catalog.
Are there public exploits for OTRS GmbH (former OTRS AG) OTRS vulnerabilities?: No OTRS GmbH (former OTRS AG) OTRS CVEs currently have a tracked public exploit in this dataset.
Which versions of OTRS GmbH (former OTRS AG) OTRS are affected?: 18 distinct OTRS GmbH (former OTRS AG) OTRS versions are named across its CVEs. Use the version filter above to see the CVEs affecting a specific version.
What are the most common weakness types in OTRS GmbH (former OTRS AG) OTRS CVEs?: OTRS GmbH (former OTRS AG) OTRS's CVEs most often map to these CWE weakness types: CWE-352 (Cross-Site Request Forgery (CSRF)), CWE-22 (Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')), CWE-290 (Authentication Bypass by Spoofing), CWE-497 (Exposure of Sensitive System Information to an Unauthorized Control Sphere).
How many critical OTRS GmbH (former OTRS AG) OTRS vulnerabilities are there?: OTRS GmbH (former OTRS AG) OTRS has 2 critical and 1 high-severity CVEs.
What is the average severity of OTRS GmbH (former OTRS AG) OTRS CVEs?: The average CVSS base score across OTRS GmbH (former OTRS AG) OTRS's scored CVEs is 6.5.

References

Vulnerability data is sourced from the CVE Program; severity, KEV, and exploit signals are aggregated by RadicalNotion.AI.

Track OTRS GmbH (former OTRS AG) OTRS vulnerabilities

Get an alert for each new OTRS GmbH (former OTRS AG) OTRS CVE, with AI-written analysis and remediation steps.

Create an account See pricing