LiveActive security incident?Get immediate response
CVE Record

CVE-2026-48247: Open ISES Tickets < 3.44.2 Disabled TLS Certificate Verification in incs/functions.inc.php

Open ISES Tickets before 3.44.2 disables TLS certificate verification in incs/functions.inc.php by setting CURLOPT_SSL_VERIFYPEER to false (and not setting CURLOPT_SSL_VERIFYHOST) when issuing outbound HTTPS requests for general-purpose outbound HTTPS requests issued by the shared helper functions. An attacker positioned on the network path between the server and the remote endpoint can present a forged certificate to intercept, monitor, or modify the request and response, including any API keys or session-bearing data in transit.

HighCVSS 8.2Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysishigh

Security readout for executives and security teams

Plain-English summary

Open ISES Tickets before 3.44.2 may trust forged certificates when connecting to HTTPS services. A network-positioned attacker could secretly read or alter those communications, potentially exposing API keys, session data, or returned information. The risk depends on the server making affected outbound requests and an attacker controlling or intercepting the network path.

Executive priority

Prioritize remediation for internet-connected or sensitive deployments that make outbound HTTPS requests. Upgrade promptly where API keys, sessions, or regulated data may transit affected helpers. Although exploitation requires network-path access, a successful interception could compromise both confidentiality and data integrity without visible user interaction.

Technical view

Shared HTTPS helper functions in incs/functions.inc.php disable peer-certificate verification with CURLOPT_SSL_VERIFYPEER set to false and do not enable hostname verification. This creates CWE-295 certificate-validation failures affecting Open ISES Tickets versions before 3.44.2. CVSS 4.0 is 8.2, reflecting potentially high confidentiality and integrity impact but high attack complexity.

Likely exposure

Exposure is most likely where a pre-3.44.2 installation uses the shared helper functions for outbound HTTPS, especially across untrusted or interceptable networks. Sensitive request headers, API credentials, session-bearing data, and responses may be at risk. The supplied evidence does not identify which integrations invoke these helpers or how commonly they carry secrets.

Exploitation context

Exploitation requires an attacker positioned between the Tickets server and its remote HTTPS endpoint, such as through compromised network infrastructure or traffic interception. No user interaction or prior application privileges are indicated. The source bundle does not report active exploitation, and the CVE is not marked as included in KEV.

Researcher notes

The vulnerable behavior is explicitly tied to shared helpers in incs/functions.inc.php. Assessment should trace every caller and characterize transmitted credentials and response trust. The structured affected entry is inconsistent with the narrative, listing version "0" while stating versions before 3.44.2; use the release and patch references to resolve asset-specific uncertainty.

Mitigation direction

  • Upgrade Open ISES Tickets to version 3.44.2 or later.
  • Review the vendor release and patch references before deployment.
  • Restrict outbound network paths from the application server where practical.
  • Rotate exposed credentials if network interception is suspected.

Validation and detection

  • Confirm the installed Open ISES Tickets version is 3.44.2 or later.
  • Verify deployed code no longer disables TLS peer verification.
  • Confirm outbound HTTPS requests reject untrusted or hostname-mismatched certificates.
  • Review logs and network telemetry for suspicious interception or unexpected endpoints.
  • Inventory secrets transmitted through integrations using the shared helper functions.
Prepared
Confidence
high
Sources
5

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cwe · low confidence lookup

CWE-295: Exact CWE lookup

Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.

Open ATT&CK lookup
cve · low confidence lookup

CVE-2026-48247 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
High
CVSS
8.2 (4.0)
Known Exploited
No
Published

Vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

2CVSS vectors
3Timeline events
1ADP providers
4Source links

SSVC decision data

CISA-ADPCISA Coordinator
Timestamp
Version
2.0.3
Exploitation: noneAutomatable: noTechnical Impact: partial

CVSS vector scores

2 official scores

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
8.2CVSS 4.0HighCVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N——VulnCheck
5.9CVSS 3.1MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N2.23.6VulnCheck

Vulnerability scoring details

Base CVSS 4.0 score

8.2High
CVSS 4.0 vector shape for CVE-2026-48247Attack VectorAttack ComplexityAttack RequirementsPrivileges RequiredUser InteractionVS ConfidentialityVS IntegrityVS AvailabilitySS ConfidentialitySS IntegritySS Availability

Vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Attack Requirements
NonePresent
Privileges Required
NoneLowHigh
User Interaction
NonePassiveActive
VS Confidentiality
HighLowNone
VS Integrity
HighLowNone
VS Availability
HighLowNone
SS Confidentiality
HighLowNone
SS Integrity
HighLowNone
SS Availability
HighLowNone

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CISA-ADPCISA ADP Vulnrichment
other:ssvc

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
Open ISESTickets0unaffected
Weakness

CWE details

CWE-295

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.

CWE-295 · source CWE mapping

Improper Certificate Validation

Improper Certificate Validation represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.

Open CWE intelligenceSame-CWE CVEs