Is CVE-2026-48697 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-48697 being exploited in the wild.

How severe is CVE-2026-48697?

Informational severity, with a CVSS score of 7.4, published 26 May 2026.

Which products and versions are affected?

FastNetMon LTD FastNetMon Community Edition Up to and including 1.2.9.

Is there a fix for CVE-2026-48697?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-48697 attacked?

It is attacked from the adjacent network or over the network, in a software library.

Am I affected by CVE-2026-48697?

Check whether you run FastNetMon LTD FastNetMon Community Edition at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-48697: FastNetMon Community Edition improper TLS certificate validation in telemetry

CVE-2026-48697 · Severity: info · CVSS 7.4 · Published 2026-05-26

FastNetMon Community Edition, a DDoS detection tool, fails to verify the identity of servers when sending telemetry data over HTTPS. This allows a network-positioned attacker to intercept and modify sensitive system information, such as CPU details, kernel versions, and traffic statistics. This flaw undermines the security of the encrypted connection, potentially exposing operational data to unauthorized parties.

Technologies: FastNetMon LTD FastNetMon Community Edition. Vendors: FastNetMon LTD.

Quick answers

Is CVE-2026-48697 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-48697 being exploited in the wild.
How severe is CVE-2026-48697?: Informational severity, with a CVSS score of 7.4, published 26 May 2026.
Which products and versions are affected?: FastNetMon LTD FastNetMon Community Edition Up to and including 1.2.9.
Is there a fix for CVE-2026-48697?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-48697 attacked?: It is attacked from the adjacent network or over the network, in a software library.
Am I affected by CVE-2026-48697?: Check whether you run FastNetMon LTD FastNetMon Community Edition at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability exists in the execute_web_request_secure() function within src/fast_library.cpp. While the code initializes a Boost.Asio SSL context and loads system CA certificates, it fails to call set_verify_mode(boost::asio::ssl::verify_peer). Consequently, the underlying OpenSSL library defaults to verify_none, allowing the TLS handshake to succeed regardless of certificate validity, expiration, or hostname mismatch. An attacker capable of intercepting network traffic (e.g., via DNS spoofing or BGP hijacking) can present a self-signed or arbitrary certificate to decrypt and modify the telemetry stream sent to community-stats.fastnetmon.com. This stream contains system fingerprinting data including CPU models, software versions, and traffic statistics.

Affected products

FastNetMon LTD FastNetMon Community Edition Up to and including 1.2.9

Timeline

2026-04-25: disclosed: Lorikeet Security notified FastNetMon LTD
2026-05-23: advisory: Lorikeet Security published detailed findings
2026-05-26: advisory: CVE-2026-48697 published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.