CVE-2026-35015 is a reflected cross-site scripting vulnerability in Open ISES Tickets before version 3.44.2. The issue exists in the do_unit_mail.php file where the the_ticket GET parameter is directly assigned to a JavaScript variable without proper input neutralization. Authenticated attackers can exploit this by crafting a URL with malicious JavaScript in the_ticket, which executes in the context of the victim's browser upon visiting the URL. This vulnerability allows script injection but requires user interaction and authentication. The CVSS 4.0 score is 5.1 (medium severity). No vendor advisory or patch information is currently available, and the product is not a cloud service.

Successful exploitation allows an authenticated attacker to execute arbitrary JavaScript in the context of a victim's browser session when they visit a maliciously crafted URL. This can lead to session hijacking, unauthorized actions on behalf of the victim, or other client-side impacts typical of reflected XSS vulnerabilities. The vulnerability requires user interaction and authentication, limiting its impact scope. There are no known active exploits reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should avoid clicking on untrusted or suspicious URLs containing the_ticket parameter. Implementing web application firewall (WAF) rules to detect and block suspicious input patterns may provide temporary mitigation. Review application code to ensure proper input sanitization and output encoding for JavaScript contexts.