External risk intelligence

NewType NT OneAPP Improper Certificate Validation Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-114220

The vulnerability involves improper certificate validation in the NT OneAPP, which allows man-in-the-middle attacks on network communications. While this requires the application to be communicating over a network, it is unclear if the application's typical deployment involves public-facing traffic or purely internal service-to-service communication. Therefore, public internet reachability is possible but not established as common.

Halo Surface Signal: 3 out of 5 — possibly public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

An improper certificate validation vulnerability has been identified in NewType Infortech's NT OneAPP. This issue could allow unauthenticated attackers on the network to intercept or alter communications by performing a man-in-the-middle attack. The primary concern is to confirm if this technology is in use and exposed to potential risks.

Attackers can intercept application communications.
Leadership should remember it impacts application data.
Confirm relevance and exposure to potential risks.

Attack Path

How an attacker could exploit the issue

Attackers can intercept or alter application communications by exploiting a flaw in how the NT OneAPP validates server certificates and hostnames. This attack, requiring only network proximity to the target, allows unauthenticated individuals to perform a man-in-the-middle attack, potentially compromising sensitive data exchanged between the application and its server.

Requires network proximity and no authentication.
Triggers via improper certificate validation.
Enables communication interception or modification.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability in NT OneAPP could allow attackers to intercept or modify data transmitted between the application and its server. This could occur when an attacker, positioned on the same network, exploits the application's failure to properly validate server certificates and hostnames during communication.

Application communications data at risk.
Intercepted via man-in-the-middle attack.
Data confidentiality and integrity compromised.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability in NT OneAPP, which allows unauthenticated network-adjacent attackers to conduct man-in-the-middle attacks, likely impacts application owners and potentially infrastructure or platform teams responsible for the NT OneAPP deployment. The first practical step is to inventory all instances of NT OneAPP, determine their network exposure and business criticality, identify the accountable owner for each instance, and then prioritize remediation efforts.

Application owners must take primary responsibility.
Verify network reachability and critical usage.
Plan and coordinate remediation actions.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is NT OneAPP?

NT OneAPP is a software product developed by NewType Infortech. It is typically used for facilitating networked communications and data exchange between an application and its associated server infrastructure.

What does Improper Certificate Validation mean for CVE-2026-114220?

This vulnerability, classified as CWE-295, means the application fails to verify the identity of the server it connects to. Because it does not check the server's security certificate or hostname, the software cannot confirm it is talking to the legitimate destination, allowing an attacker to insert themselves into the connection.

How can an attacker trigger this vulnerability?

An attacker must be network-adjacent, meaning they have to share the same network segment as the application traffic. The issue is not triggered by user-supplied input files or standard application settings; rather, it is a flaw in how the software handles network handshake protocols during normal operation.

Do I need to worry if my NT OneAPP instance is internal?

Halo Surface Signal indicates that while the vulnerability requires network proximity, it is unclear if your specific use case involves public internet traffic or purely internal communication. You should evaluate if an attacker with access to your local network could intercept traffic, as the risk exists regardless of whether the service faces the public internet.

When should I begin responding to this threat?

You should start immediately by creating an inventory of all NT OneAPP instances in your environment. Once you have identified where the software is running and who is responsible for each deployment, you can begin coordinating with your technical teams to verify network exposure and prioritize necessary updates or configuration changes.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.