CVE-2026-48188Disclosure(otrs / otrs)

LOWCVSS 9.1 · CRITICAL

Signal is active with 1 mentions in latest observed window

Immediate actions

Patch otrs otrs systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

An improper Input Validation vulnerability in OTRS or ((OTRS)) Community Edition database layer module allows an unauthenticated SQL injection which can lead to an authentication bypass. This issue only affects the system if the MySQL/MariaDB server is configured with the NO_BACKSLASH_ESCAPES SQL mode. This issue affects OTRS: * 7.0.X * 8.0.X * 2023.X * 2024.X * 2025.X * 2026.X before 2026.4.X * (OTRS)) Community Edition: 6.0.x Products based on the ((OTRS)) Community Edition also very likely to be affected

otrs CVEs Back to dashboard

0.5/ 10 priority

Sources & remediation

Vendor / third-party advisories

https://otrs.com/release-notes/otrs-security-advisory-2026-02/

Weakness type (CWE)

CWE-20

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

otrs

Threat summary

Patch or workaround signal is available
5 mentions across 4 observed days
Momentum state: stable

What's happening

Patch or workaround mentioned in 2 signals
Technical details provided in 3 signals
Disclosure: 3 classified signals
General: 1 classified signal
Peaked 3d ago at 2 mentions (2026-06-01); latest day: 1
5 total mentions across 4 days

Affected systems

Vendors

otrs

Products

otrs

Deep dive

Activity timeline5 mentions / 4d

Signal classification3 categories

Disclosure

360.0%

Patch

120.0%

General

120.0%

Referenced assets3 URLs

By indicator

Classification over time

Date	Total	Labels

2026-06-01	2	Disclosure1Patch1
2026-06-07	1	Disclosure1
2026-06-19	1	Disclosure1
2026-06-21	1	General1

Full discourse5 posts

ケイ | IT・セキュリティ系副業Webライター@Teeeda_worker116d
General
【緊急】CVE-2026-48188 OTRS ((OTRS)) Community Editionに深刻な脆弱性｜即時対応が必要 https://www.cybernote.click/2026/06/14/cve-2026-48188-otrs-otrs-community-edition/ #IT #Security #cybersecurity
Post summary
The tweet alerts to a critical CVE‑2026‑48188 affecting OTRS Community Edition but provides no technical details, exploit proofs, or patch information.
0000048
208 followersView on X
ケイ | IT・セキュリティ系副業Webライター@Teeeda_worker118d
Disclosure
【緊急】CVE-2026-48188 OTRS ((OTRS)) Community Editionに深刻な脆弱性｜即時対応が必要 https://www.cybernote.click/2026/06/14/cve-2026-48188-otrs-otrs-community-edition/ #IT #Security #cybersecurity
Post summary
The message alerts users to a serious vulnerability in OTRS Community Edition (CVE‑2026‑48188), urging immediate action, but offers no technical detail, PoC, or evidence of active exploitation.
0000038
209 followersView on X
Hugo | DevOps | Cybersecurity 🇱🇻@HugoValters130d
Disclosure
CVE-2026-48188 - Critical SQL injection in OTRS. Unauthenticated attackers can bypass authentication via MySQL/MariaDB with NO_BACKSLASH_ESCAPES mode. CVSS 9.1. No patch available. Disable affected #SQL mode immediately. #CVE #OTRS #infosec #CVEAlert More https://www.valtersit.com/cve/CVE-2026-48188/
Post summary
The tweet discloses a critical SQL injection in OTRS that allows unauthenticated authentication bypass, highlights lack of an available patch, and recommends disabling the NO_BACKSLASH_ESCAPES mode as a mitigation.
0000043
919 followersView on X
Upwind Security MDR@UpwindMDR136d
Patch
🚨Critical - OTRS Helpdesk Authentication Bypass (CVE-2026-48188) Unauthenticated attackers can bypass authentication and impersonate any user to access all tickets and sensitive data via SQL injection when MySQL/MariaDB is running with NO_BACKSLASH_ESCAPES mode enabled. 👉Affected: OTRS 7.x, 8.x, 2023.x, 2024.x, 2025.x and 2026.x (prior to 2026.4) ✅Patched in: OTRS 2026.4 and newer
Post summary
The post discloses a critical authentication bypass in OTRS caused by SQL injection when MySQL is running with NO_BACKSLASH_ESCAPES, and indicates the issue is resolved in OTRS 2026.4 and later.
00000100
197 followersView on X
Vulmon Vulnerability Feed@VulmonFeeds136d
Disclosure
CVE-2026-48188 Unauthenticated SQL Injection in OTRS Community Edition Database Layer Module https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-48188
Post summary
A new CVE is disclosed describing an unauthenticated SQL injection in the OTRS Community Edition database module without any PoC, exploit code, active exploitation, or patch information.
0000091
4.0K followersView on X

CPE platform detail2 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

2 of 2 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	otrs	otrs	-	-	-
App	otrs	otrs	-	-	-

Explore more

Back to dashboard otrs CVEs otrs vulnerabilities

What researchers are saying

CVE-2026-48188

Hugo | DevOps | Cybersecurity 🇱🇻[verified]@HugoValtersDisclosure

The tweet discloses a critical SQL injection in OTRS that allows unauthenticated authentication bypass, highlights lack of an available patch, and recommends disabling the NO_BACKSLASH_ESCAPES mode as a mitigation.

Upwind Security MDR[verified]@UpwindMDRPatch

The post discloses a critical authentication bypass in OTRS caused by SQL injection when MySQL is running with NO_BACKSLASH_ESCAPES, and indicates the issue is resolved in OTRS 2026.4 and later.

ケイ | IT・セキュリティ系副業Webライター@Teeeda_workerGeneral

The tweet alerts to a critical CVE‑2026‑48188 affecting OTRS Community Edition but provides no technical details, exploit proofs, or patch information.

ケイ | IT・セキュリティ系副業Webライター@Teeeda_workerDisclosure

The message alerts users to a serious vulnerability in OTRS Community Edition (CVE‑2026‑48188), urging immediate action, but offers no technical detail, PoC, or evidence of active exploitation.

Vulmon Vulnerability Feed@VulmonFeedsDisclosure

A new CVE is disclosed describing an unauthenticated SQL injection in the OTRS Community Edition database module without any PoC, exploit code, active exploitation, or patch information.