‹ Back to list

CVE-2026-78356

Status: DeferredMedium (5.3)—
Severity5.3Medium · CVSS 3.1
Exploitation probability0.28 %higher than 20% of CVEs
Active exploitationNonot in the CISA catalog
Public exploitNot knownno public code found

The OTRS Agent Frontend configuration endpoint can be accessed without authentication. This allows unauthenticated remote users to retrieve internal application configuration that is intended for use by the authenticated Agent Frontend. The exposed information may include configured frontend routes and their associated authorization groups, authentication configuration, enabled product features, third-party integration settings, and other implementation details.

The exposed configuration does not directly contain user credentials or provide unauthorized modification of the OTRS configuration.

Read full descriptionShow less

However, the disclosed information may assist an attacker in fingerprinting the affected OTRS installation and identifying enabled functionality or security-relevant configuration that could be used to prepare further attacks.

This issue affects OTRS:

Technical details traces, logs and code from the original report
  *  8.0.X
  *  2023.X
  *  2024.X
  *  2025.X
  *  2026.X before 2026.7.X

CVSS

Base score
5.3
Version
3.1
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Exploitation probability (EPSS)

Probability of exploitation in the next 30 days
0.28 %
Percentile among all scored CVEs
20
Score date
10/24/2026

EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).

ATT&CK techniques

How this vulnerability is exploited and what the attacker gains, in MITRE ATT&CK terms.

Acceso remoto sin autenticación a endpoint de configuración (AV:N/PR:N/UI:N); expone rutas, grupos de autorización y detalles de implementación usables para reconocimiento y fingerprinting del objetivo.

Inferred by our analysis agent from the official description, CVSS vector and CWE, and checked by a supervisor. May contain errors.

ATT&CK mitigations that cover these techniques

Vulnerability ScanningPrivileged Account ManagementNetwork SegmentationLimit Access to Resource Over NetworkFilter Network TrafficApplication Isolation and Sandboxing

Affected technologies (1)

⚠ AI-inferred from the description — NVD hasn't analyzed this CVE yet, these aren't verified CPEs.

Otrs — OtrsAI

CWEs

References

Show 1 references

Raw JSON (NVD)

Show
{
  "id": "CVE-2026-78356",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-78356",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-10-15T18:00:38.562475Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security@otrs.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 5.3,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 1.4,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "security@otrs.com",
      "affectedData": [
        {
          "vendor": "OTRS GmbH (former OTRS AG)",
          "modules": [
            "Agent Interface"
          ],
          "product": "OTRS",
          "versions": [
            {
              "status": "affected",
              "version": "8.0.x"
            },
            {
              "status": "affected",
              "version": "2023.x"
            },
            {
              "status": "affected",
              "version": "2024.x"
            },
            {
              "status": "affected",
              "version": "2025.x"
            },
            {
              "status": "affected",
              "version": "2026.x",
              "versionType": "patch",
              "lessThanOrEqual": "2026.6.x"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2026-10-12T07:16:36.890",
  "references": [
    {
      "url": "https://otrs.com/release-notes/otrs-security-advisory-2026-13/",
      "source": "security@otrs.com"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security@otrs.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-497"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "The OTRS Agent Frontend configuration endpoint can be accessed without authentication. This allows unauthenticated remote users to retrieve internal application configuration that is intended for use by the authenticated Agent Frontend. The exposed information may include configured frontend routes and their associated authorization groups, authentication configuration, enabled product features, third-party integration settings, and other implementation details.\n\nThe exposed configuration does not directly contain user credentials or provide unauthorized modification of the OTRS configuration. However, the disclosed information may assist an attacker in fingerprinting the affected OTRS installation and identifying enabled functionality or security-relevant configuration that could be used to prepare further attacks.\n\nThis issue affects OTRS:\n\n  *  8.0.X\n  *  2023.X\n  *  2024.X\n  *  2025.X\n  *  2026.X before 2026.7.X"
    }
  ],
  "lastModified": "2026-10-15T20:38:44.050",
  "sourceIdentifier": "security@otrs.com"
}