CVE-2026-48226 is a reflected cross-site scripting vulnerability in Open ISES Tickets prior to version 3.44.2. It arises from improper neutralization of input in the os_watch.php file, where the ref and mode_orig POST parameters are inserted into hidden input HTML elements without sufficient sanitization. Authenticated attackers can exploit this by crafting malicious requests that cause arbitrary JavaScript execution in the context of the victim's browser session.

Successful exploitation allows an authenticated attacker to execute arbitrary JavaScript in the victim's browser, potentially leading to session hijacking, unauthorized actions, or information disclosure within the scope of the affected application. The vulnerability is rated medium severity with a CVSS 4.0 score of 5.1. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to trusted users only and monitor for suspicious activity related to os_watch.php. Avoid using affected versions in exposed environments if possible.