CVE-2026-35014 is a reflected cross-site scripting vulnerability in Open ISES Tickets prior to version 3.44.2. The issue exists in routes_nm.php where the ticket_id GET parameter is directly embedded into a hidden input field's VALUE attribute without proper input neutralization. Authenticated attackers can craft URLs with malicious JavaScript payloads in the ticket_id parameter, causing the script to execute in the context of the victim's browser upon visiting the URL. This vulnerability requires user interaction and authentication but does not require elevated privileges. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges required, user interaction required, and low scope impact.

Successful exploitation allows an authenticated attacker to execute arbitrary JavaScript in the victim's browser session. This can lead to actions such as session hijacking, unauthorized actions performed on behalf of the victim, or other client-side attacks within the context of the vulnerable application. However, the attack requires the victim to be authenticated and to visit a maliciously crafted URL. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should avoid clicking on untrusted links containing ticket_id parameters. Application administrators should monitor vendor channels for updates and apply patches once released. No official remediation or temporary workaround is currently documented.