What is CVE-2002-0862?

CVE-2002-0862 is a vulnerability in Apple macOS, classified under Improper Certificate Validation. Published 2002-10-04.

Is CVE-2002-0862 known to be exploited?

2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Vulnerability in Apple macOS

CVE-2002-0862

The (1) CertGetCertificateChain, (2) CertVerifyCertificateChainPolicy, and (3) WinVerifyTrust APIs within the CryptoAPI for Microsoft products including Microsoft Windows 98 through XP, Office for Mac, Internet Explorer for Mac, and Outlook Express for Mac, do not properly verify the Basic Constraints of intermediate CA-signed X.509 certificates, which allows remote attackers to spoof the certificates of trusted sites via a man-in-the-middle attack for SSL sessions, as originally reported for Internet Explorer and IIS.

Vulnerability class: Improper Certificate Validation

Published 2002-10-04 · last modified 2026-06-16.

CVSS v2 metric

CVSS v2 base score 6.8 (Medium). Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P. This CVE predates CVSS v3 and has no v3 score from NVD.

EPSS exploit prediction

EPSS: 0.158 (96.8th percentile), scored 2026-09-29.

Moderate probability of exploitation in the next 30 days — watch for active exploitation reports. 97th percentile — 96.8% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS over last 30 days · oldest: 0.158 · newest: 0.158 · change: 0.000

Affected products

Weakness classification (CWE)

CWE-295 — Improper Certificate Validation

Public proof-of-concept exploits

References

oval.cisecurity.org/repository/search/definition/oval:org.mitre.oval:def:1332 (Broken Link, signature, vdb-entry)
marc.info/ (mailing-list, Mailing List)
oval.cisecurity.org/repository/search/definition/oval:org.mitre.oval:def:1056 (Broken Link, signature, vdb-entry)
marc.info/ (mailing-list, Mailing List)
exchange.xforce.ibmcloud.com/vulnerabilities/9776 (VDB Entry, Third Party Advisory, vdb-entry)
marc.info/ (mailing-list, Mailing List)
oval.cisecurity.org/repository/search/definition/oval:org.mitre.oval:def:2671 (Broken Link, signature, vdb-entry)
docs.microsoft.com/en-us/security-updates/securitybulletins/2002/ms02-050 (vendor-advisory, Patch, Vendor Advisory)

Frequently asked questions

What is CVE-2002-0862?: CVE-2002-0862 is a vulnerability in Apple macOS, classified under Improper Certificate Validation. Published 2002-10-04.
Is CVE-2002-0862 known to be exploited?: 2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.