CVE-2026-35014 is a reflected cross-site scripting vulnerability in Open ISES Tickets affecting versions prior to 3.44.2. The issue occurs in routes_nm.php where the ticket_id GET parameter is directly inserted into a hidden input field's VALUE attribute without proper neutralization. Authenticated attackers can exploit this by crafting a URL containing malicious JavaScript in the ticket_id parameter, which executes in the context of the victim's browser upon visiting the URL. This could lead to script execution attacks such as session hijacking or other client-side impacts.

The vulnerability allows authenticated attackers to execute arbitrary JavaScript in the context of the victim's browser by exploiting improper input neutralization. This can lead to typical reflected XSS impacts such as theft of session tokens, defacement, or redirection to malicious sites. However, the attack requires the victim to be authenticated and to visit a maliciously crafted URL. There are no known exploits in the wild as of the published date.

No official patch or remediation has been confirmed or published by the vendor as of the current information. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid clicking on untrusted links containing ticket_id parameters and consider implementing web application firewall (WAF) rules to detect and block suspicious input patterns targeting the ticket_id parameter.