CVE-2026-35014 is a reflected cross-site scripting vulnerability in Open ISES Tickets before version 3.44.2. It arises from improper neutralization of input in the routes_nm.php script, specifically through the ticket_id GET parameter. The parameter's value is directly inserted into a hidden input field's VALUE attribute without sanitization, allowing authenticated attackers to inject and execute arbitrary JavaScript in the context of the victim's browser session. This vulnerability requires user interaction (visiting a crafted URL) and does not require elevated privileges beyond authentication.

Successful exploitation allows an authenticated attacker to execute arbitrary JavaScript in the victim's browser, potentially leading to session hijacking, defacement, or other client-side attacks within the scope of the affected application. The vulnerability is limited to authenticated users and requires the victim to visit a maliciously crafted URL. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should avoid clicking on untrusted links containing ticket_id parameters in Open ISES Tickets. Implementing input validation or output encoding on the ticket_id parameter can mitigate the risk. Monitor vendor channels for updates regarding an official patch or workaround.