Medium severity · published Oct 12, 2026
CVE-2026-48212
Stored XSS in external pages
4.8
CVSS
0.1%
EPSS
No
On KEV
Description
An OTRS administrator can enter arbitrary JavaScript into the content of an OTRS Custom Page, which is stored by the application and subsequently executed in the browser of users accessing that page.
This issue affects OTRS:
* 7.0.X
* 8.0.X
* 2023.X
* 2024.X
* 2025.X
* 2026.X before 2026.7.X
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.1% · higher than 4% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OT
OTRS · OTRS GmbH (former OTRS AG)
7.0.x; 8.0.x; 2023.x; 2024.x; 2025.x; 2026.x through 2026.6.x · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-48212
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-48212
otrs.com
https://otrs.com/release-notes/otrs-security-advisory-2026-11/
More from OTRS
9.1
CVE-2026-78357
Insufficient Session Revocation for JWT Authentication
8.7
CVE-2026-78355
Path Traversal in SendSupportBundle allows File Deletion Outside the Intended Directory
6.1
CVE-2026-93581
Insufficient Neutralization of Formula Elements in CSV Exports
5.4
CVE-2026-78359
Duplicate Identity / Identity Shadowing across CustomerUser backends
5.4
CVE-2026-48211
Cross-Site Request Forgery in Import/Export Admin console