Quick answers
- Is CVE-2026-48226 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-48226 being exploited in the wild.
- How severe is CVE-2026-48226?
- Medium severity, with a CVSS score of 5.4, published 21 May 2026.
- Which products and versions are affected?
- Open ISES Tickets < 3.44.2.
- Is there a fix for CVE-2026-48226?
- A patch was published on 2026-04-01: Fix committed to repository Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-48226 attacked?
- It is attacked over the network, in a network appliance.
- Am I affected by CVE-2026-48226?
- Check whether you run Open ISES Tickets at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
A reflected cross-site scripting (XSS) vulnerability exists in Open ISES Tickets versions prior to 3.44.2. The flaw is located in 'os_watch.php', where the 'ref' and 'mode_orig' POST parameters are not properly sanitized before being rendered into the value attributes of hidden HTML form inputs. An authenticated attacker can exploit this by crafting a malicious request that, when processed by a victim's browser, executes arbitrary JavaScript in the context of the victim's session. This vulnerability was addressed in version 3.44.2 by implementing input sanitization using htmlspecialchars() with ENT_QUOTES.
Affected products
- Open ISES Tickets < 3.44.2
Timeline
- 2026-04-01: patched: Fix committed to repository
- 2026-04-02: advisory: Release v3.44.2 published
- 2026-05-21: disclosed: CVE-2026-48226 published