PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-35012 openises CVE debrief

CVE-2026-35012 affects Open ISES Tickets before version 3.44.2 and is a reflected cross-site scripting issue in add_facnote.php. The issue occurs when an unsanitized ticket_id GET parameter is written into a hidden input field's value attribute, allowing attacker-controlled script to execute in a victim's browser when a crafted URL is visited. NVD and the VulnCheck advisory both point to a fix in the 3.44.2 release line.

Vendor
openises
Product
tickets
CVSS
MEDIUM 5.1
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-20
Original CVE updated
2026-07-23
Advisory published
2026-05-20
Advisory updated
2026-07-23

Who should care

Administrators and security teams responsible for Open ISES Tickets deployments, especially instances running versions earlier than 3.44.2. Help desk, ticketing, and support teams should also care because the vulnerable flow is tied to ticket note handling and can affect authenticated users who open crafted links.

Technical summary

The vulnerability is a reflected XSS (CWE-79) in add_facnote.php. An unsanitized ticket_id parameter is inserted into a hidden input element's VALUE attribute, which can break attribute context and enable JavaScript injection. The NVD record cites a fixing commit and the v3.44.2 release as references, indicating the issue was addressed in that version.

Defensive priority

Medium. The issue is externally reachable and can lead to script execution in a user's browser, but it requires user interaction and appears to require authenticated access to the affected function.

Recommended defensive actions

  • Upgrade Open ISES Tickets to version 3.44.2 or later.
  • Review and, if needed, invalidate any links or workflows that pass ticket_id values into add_facnote.php.
  • Audit the affected code path for output encoding and context-aware escaping before rendering HTML attributes.
  • Add server-side validation for ticket_id to enforce expected format and reject unexpected characters.
  • Use security headers such as a restrictive Content Security Policy to reduce the impact of any remaining XSS paths.
  • Monitor logs for suspicious requests to add_facnote.php with unusual ticket_id values.

Evidence notes

The vulnerability description, affected version boundary, and CWE-79 classification come from the supplied CVE record and associated NVD metadata. NVD lists a fixing commit (ecfeb406a016766cae81c749e14b5145a9f2dbff), the v3.44.2 release tag, and the VulnCheck advisory as references. The vendor field in the supplied corpus is low confidence and marked for review, so this debrief focuses on the product and vulnerability details that are directly supported.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-35012 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-35012

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-35012 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-35012

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.