CVE-2026-35007 is a reflected cross-site scripting vulnerability in Open ISES Tickets affecting versions prior to 3.44.2. The vulnerability exists in the single_unit.php file where the id GET parameter is directly embedded into an HTML attribute without proper neutralization. Authenticated attackers can exploit this by crafting a URL with malicious JavaScript in the id parameter, leading to script execution in the context of the victim's browser upon visiting the URL. This can potentially be used to perform actions on behalf of the victim or steal sensitive information accessible via the browser session.

Successful exploitation allows authenticated attackers to execute arbitrary JavaScript in the context of a victim's browser session. This can lead to session hijacking, unauthorized actions, or theft of sensitive information accessible through the browser. The vulnerability requires user interaction (visiting a crafted URL) and authentication, which limits the attack surface but still poses a significant risk to users of affected versions.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should avoid clicking on suspicious links containing the id parameter in Open ISES Tickets. Implementing web application firewall (WAF) rules to detect and block malicious input in the id parameter may provide temporary mitigation. Monitor vendor channels for updates regarding an official patch or workaround.