CVE-2026-35009 is a reflected cross-site scripting vulnerability in Open ISES Tickets prior to version 3.44.2. The issue exists in add_note.php where the ticket_id GET parameter is not properly neutralized before being embedded into a hidden input field's VALUE attribute. Authenticated attackers can exploit this by crafting a URL with malicious JavaScript in the ticket_id parameter, which executes when visited by a user. This vulnerability allows script injection but requires user interaction and authentication. The CVSS 4.0 score is 5.1 (medium severity). No patch or official remediation level is currently documented.

Successful exploitation allows an authenticated attacker to execute arbitrary JavaScript in the context of a victim's browser session when they visit a maliciously crafted URL. This can lead to session hijacking, unauthorized actions performed on behalf of the victim, or other client-side impacts typical of reflected XSS. However, exploitation requires the attacker to be authenticated and the victim to interact with the malicious link. There is no indication of privilege escalation or server-side compromise from this vulnerability alone.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should avoid clicking on untrusted URLs containing ticket_id parameters in Open ISES Tickets. Administrators should monitor vendor communications for updates and apply patches promptly once released. No official mitigation or temporary fix is documented at this time.