CVE-2026-35012 is a reflected cross-site scripting vulnerability in Open ISES Tickets affecting versions prior to 3.44.2. The issue exists in add_facnote.php where the ticket_id GET parameter is directly embedded into a hidden input field's VALUE attribute without proper neutralization. Authenticated attackers can exploit this by crafting URLs that inject JavaScript payloads, which execute in the context of the victim's browser upon visiting the URL. This vulnerability could lead to script execution but requires user interaction and authentication.

Successful exploitation allows an authenticated attacker to execute arbitrary JavaScript in the context of the victim's browser session. This can lead to actions such as session hijacking, defacement, or other client-side attacks depending on the injected script. However, the attack requires the victim to be authenticated and to visit a maliciously crafted URL.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch is indicated, users should monitor the vendor's communications for updates. Until a fix is available, limit exposure by restricting access to trusted users and educating users about the risks of clicking untrusted links. Avoid sharing URLs with unsanitized parameters.