The vulnerability CVE-2026-48247 affects Open ISES Tickets versions prior to 3.44.2. The issue arises because the software disables TLS certificate verification in the file incs/functions.inc.php by setting CURLOPT_SSL_VERIFYPEER to false and not setting CURLOPT_SSL_VERIFYHOST when making outbound HTTPS requests. This improper validation enables a man-in-the-middle attacker on the network path to present a forged TLS certificate, thereby intercepting, monitoring, or modifying the HTTPS requests and responses, including sensitive data transmitted in these requests.

An attacker positioned on the network path can exploit this vulnerability to intercept or alter HTTPS communications initiated by the affected Open ISES Tickets software. This can lead to exposure of sensitive information such as API keys or session tokens, potentially compromising confidentiality and integrity of data in transit.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should avoid using affected versions or implement network-level protections such as TLS interception detection. Monitor vendor channels for updates regarding a patch or official remediation.