PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-35009 openises CVE debrief

CVE-2026-35009 is a reflected cross-site scripting issue reported in Open ISES Tickets before version 3.44.2. The published description says an unsanitized ticket_id GET parameter is reflected into a hidden input VALUE attribute in add_note.php, allowing an authenticated attacker to inject JavaScript that runs in a victim's browser when a crafted URL is opened. The linked 3.44.2 release and commit indicate the issue was addressed in that version. While the CVSS score is 5.1 (Medium), reflected XSS can still matter in ticketing workflows because it may expose user actions or data in the browser context.

Vendor
openises
Product
tickets
CVSS
MEDIUM 5.1
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-20
Original CVE updated
2026-05-21
Advisory published
2026-05-20
Advisory updated
2026-05-21

Who should care

Administrators, application owners, and security teams running Open ISES Tickets, especially instances on versions earlier than 3.44.2. Helpdesk or support staff who may open links shared through email, chat, or ticket comments are also relevant because the exploit requires user interaction.

Technical summary

The advisory describes a reflected XSS path in add_note.php. A request parameter named ticket_id is passed into HTML without proper output encoding and appears in a hidden input value attribute. If an authenticated attacker supplies a crafted URL, the browser can interpret injected script content in the page context when the victim visits the link. The supplied references point to a fix in Open ISES Tickets 3.44.2 and an associated GitHub commit.

Defensive priority

Medium priority. The vulnerability is browser-side and requires authentication plus user interaction, but it can still be impactful in internal ticketing systems where privileged users routinely follow shared links.

Recommended defensive actions

  • Upgrade Open ISES Tickets to version 3.44.2 or later.
  • Review add_note.php and related code paths for request parameters rendered into HTML attributes.
  • Apply context-appropriate output encoding to ticket_id and any similar values before placing them in markup.
  • If patching is delayed, limit access to the application and treat untrusted ticket links with caution.
  • Monitor application logs for suspicious add_note.php requests that carry unexpected ticket_id values.

Evidence notes

This debrief is based on the supplied NVD record, the linked Vulncheck advisory, the GitHub commit reference, and the Open ISES Tickets 3.44.2 release tag. The CVE and NVD timestamps supplied in the corpus are both 2026-05-20T20:16:38.063Z. Vendor/product attribution in the source corpus is low-confidence, so the product name is taken from the vulnerability description and linked release references rather than vendor metadata.

Official resources

Published and modified on 2026-05-20 per the supplied CVE and NVD timestamps. The linked references indicate the issue was fixed in Open ISES Tickets 3.44.2.