CVE-2026-35009 is a reflected cross-site scripting vulnerability in Open ISES Tickets prior to version 3.44.2. The issue exists in add_note.php where the ticket_id GET parameter is directly inserted into a hidden input field's VALUE attribute without proper neutralization. Authenticated attackers can exploit this by crafting a URL containing malicious JavaScript in the ticket_id parameter, which executes in the context of the victim's browser when the URL is accessed. This vulnerability can lead to script execution attacks but requires user interaction and authentication.

An attacker who is authenticated can inject and execute arbitrary JavaScript in the context of a victim's browser by exploiting the unsanitized ticket_id parameter. This can lead to session hijacking, unauthorized actions on behalf of the user, or other client-side attacks. The vulnerability requires the victim to visit a maliciously crafted URL. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid clicking on untrusted links containing ticket_id parameters and restrict access to the affected application to trusted users. Monitor vendor communications for updates regarding patches or official mitigations.