Open ISES Tickets Vulnerability in Outbound HTTPS Requests

CVE-2026-48247

What is CVE-2026-48247?

The Open ISES Tickets application prior to version 3.44.2 contains a vulnerability that disables TLS certificate verification when making outbound HTTPS requests. Specifically, by setting CURLOPT_SSL_VERIFYPEER to false and failing to set CURLOPT_SSL_VERIFYHOST, the application exposes itself to potential security risks. An attacker could exploit this weakness by inserting themselves into the network path between the application server and external resources, allowing them to present a fraudulent SSL certificate. This can lead to interception, monitoring, or modification of sensitive information, such as API keys or user session data, thereby posing a significant threat to data integrity and confidentiality.

References