Open ISES Tickets SQL Injection (CVE-2026-48239) Allows Database Manipulation

A high-severity SQL injection vulnerability, tracked as CVE-2026-48239, has been identified in Open ISES Tickets versions prior to 3.44.2. According to the National Vulnerability Database, this flaw exists in the ajax/reports.php component, specifically where the tick_id POST parameter is incorporated into the WHERE clause of SELECT statements within the incidents summary report without proper sanitization.

This critical oversight enables authenticated attackers to craft malicious requests that can alter query semantics. The National Vulnerability Database indicates that successful exploitation grants attackers the ability to read, modify, or even destroy database contents. With a CVSS score of 7.1 (High), the vulnerability presents a significant risk, particularly given its network attack vector and low privileges required for exploitation.

Defenders leveraging Open ISES Tickets must prioritize patching to version 3.44.2 or later immediately. Organizations should also review incident summary report access permissions and monitor database logs for any anomalous activity that might indicate attempted or successful exploitation. The attacker’s calculus here is straightforward: leverage a common web vulnerability to gain control over critical data with minimal effort, given an authenticated session.