CVE-2026-35012 is a reflected cross-site scripting vulnerability in Open ISES Tickets before version 3.44.2. The flaw exists in add_facnote.php where the ticket_id GET parameter is directly embedded into a hidden input field's VALUE attribute without proper input neutralization. This allows authenticated attackers to craft URLs that execute arbitrary JavaScript in the context of the victim's browser session when the URL is accessed. The vulnerability is rated medium severity with a CVSS 4.0 score of 5.1. No official fix or patch has been documented, and the product is not a cloud service, so remediation depends on vendor updates or user mitigation.

Successful exploitation of this vulnerability allows an authenticated attacker to execute arbitrary JavaScript in the browser of a user who visits a maliciously crafted URL. This can lead to session hijacking, unauthorized actions performed on behalf of the user, or other client-side impacts typical of reflected XSS. However, the attack requires user interaction (visiting the malicious URL) and authentication, which limits the scope and ease of exploitation. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should exercise caution when clicking on URLs containing ticket_id parameters from untrusted sources. Implementing web application firewall (WAF) rules to detect and block suspicious input patterns may help mitigate risk. Vendors and administrators should monitor for updates from the Open ISES Tickets project regarding patches or official mitigations.