Unrated severityNVD Advisory· Published Jul 14, 2026· Updated Aug 4, 2026

CVE-2026-36214

Description

osTicket versions from 1.10 up to 1.17.7 and from 1.18.0 up to 1.18.3 are vulnerable to a stored XSS due to a vulnerable Bootstrap Tooltip component and insufficient HTML sanitization, allowing remote attackers to execute arbitrary JavaScript in Agent or Admin sessions.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Osticket/Osticketllm-fuzzy
Range: 1.10 - 1.17.7, 1.18.0 - 1.18.3

Patches

Vulnerability mechanics

References

enhancesoft.commitre
github.com/osTicket/osTicket/commit/5afdf5450ff5c7d218447014b7abbb5f1e6dd42fmitre
github.com/osTicket/osTicket/releases/tag/v1.17.8mitre
github.com/osTicket/osTicket/releases/tag/v1.18.4mitre
osticket.commitre

News mentions

No linked articles in our index yet.

cvss	0.000
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000