This vulnerability (CVE-2026-6060) affects multiple versions of OTRS, specifically the SQL Box feature in the admin interface. It allows an attacker with high privileges and user interaction to cause uncontrolled resource consumption, resulting in a denial of service condition against the webserver. The CVSS 3.1 base score is 4.5 (medium), reflecting network attack vector, low attack complexity, required privileges, and user interaction, with impact limited to availability. No known exploits are reported, and no vendor-provided patch or mitigation details are available at this time.

Successful exploitation leads to denial of service by exhausting system resources on the webserver hosting OTRS, potentially disrupting service availability. There is no confidentiality or integrity impact reported. The attack requires authenticated access with high privileges and user interaction, limiting the attack surface.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the admin interface to trusted users only and monitor for unusual resource usage patterns. Avoid executing untrusted input in the SQL Box component. Follow vendor updates closely for any forthcoming patches or official mitigations.