The vulnerability in Open ISES Tickets (CVE-2026-35015) is a reflected cross-site scripting issue in the do_unit_mail.php file. Authenticated attackers can exploit this by supplying a malicious JavaScript payload through the the_ticket GET parameter, which is directly assigned to a JavaScript variable without proper input neutralization. This leads to script execution in the context of the victim's browser when the crafted URL is accessed. The affected versions include all releases prior to 3.44.2. There is no vendor advisory or patch information available at this time.

Successful exploitation allows an authenticated attacker to execute arbitrary JavaScript in the context of the victim's browser. This can lead to session hijacking, unauthorized actions on behalf of the user, or other client-side impacts typical of reflected XSS vulnerabilities. The vulnerability requires user interaction (clicking a malicious link) and authentication, limiting the attack scope. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should avoid clicking suspicious links containing the_ticket parameter. Administrators should monitor for updates from the vendor regarding patches or mitigations. No official remediation or temporary fix is currently documented.