Read the docs
TI-2026-08352 Aliases CVE-2026-9507GHSA-6cj6-2fg2-2r4g

Session fixation vulnerability in Enhancesoft's osTicket

Priority LOW 25CWE-38Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Active
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
Low · Low · None
Fix status
No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

A session fixation vulnerability has been identified in osTicket v1.18.2. This security flaw allows an attacker to hijack a victim’s account by keeping the initial session identifier (OSTSESSID) active after a successful login. The issue lies in the fact that the application does not invalidate the pre-authentication cookie or generate a new identifier for the authenticated context. As a result, if an attacker manages to set a known session identifier in the victim’s browser, they will be able to maintain unauthorised access to the account once the victim has authenticated.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00403 34th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
EnhancesoftosTicket1.18.2—No fix listedCNA
  • osTicket VendorEnhancesoft Affected 1.18.2 Fixed in — No fix listed CNA

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-9507
  2. 2026-10-03 Alias added: GHSA-6cj6-2fg2-2r4g

References

Patch 1

  • TI-2026-17810 osTicket (1.18.x < 1.18.3, 1.17.x < 1.17.7) PDF Export Arbitrary File Read CVSS 4.0HIGH 8.7
  • TI-2022-13729 SQL Injection vulnerability in audit/class.audit.php in osTicket osTicket-plugins before… CVSS 3.1CRITICAL 9.8
  • TI-2020-15225 SSRF exists in osTicket before 1.14.3, where an attacker can add malicious file to server or perform port scanning. CVSS 3.1CRITICAL 9.8
  • TI-2022-13727 Session Fixation vulnerability in in function login in class.auth.php in osTicket through 1.16.2. CVSS 3.1HIGH 8.8
  • TI-2025-19272 A SQL injection vulnerability in the "Search" functionality of "tickets.php" page in… CVSS 3.1MEDIUM 6.5
  • TI-2023-14123 A denial of service attack might be launched against the server if an unusually lengthy… CVSS 3.1HIGH 7.5
See all 48 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences