# CVE-2026-48226: Open ISES Tickets Reflected XSS in os_watch.php

Source: https://junglewise.ai/threats/cve-2026-48226-open-ises-tickets-reflected-xss-in-os-watch-php  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-21. Updated: 2026-05-21  
License: CC BY 4.0 with a link back

CVE-2026-48226 · Severity: medium · CVSS 5.4 · Published 2026-05-21

Open ISES Tickets, an open-source ticketing and incident management system, contains a security flaw in its 'os_watch.php' component. An authenticated attacker can trick a user into executing malicious scripts within their browser. This could lead to unauthorized actions being performed on behalf of the user, such as data theft or session hijacking.

Technologies: [Open ISES Tickets](https://junglewise.ai/threats/technologies/tickets). Vendors: [Open ISES](https://junglewise.ai/threats/vendors/open-ises).

## Quick answers

**Is CVE-2026-48226 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-48226 being exploited in the wild.

**How severe is CVE-2026-48226?** Medium severity, with a CVSS score of 5.4, published 21 May 2026.

**Which products and versions are affected?** Open ISES Tickets < 3.44.2.

**Is there a fix for CVE-2026-48226?** A patch was published on 2026-04-01: Fix committed to repository Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-48226 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-48226?** Check whether you run Open ISES Tickets at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A reflected cross-site scripting (XSS) vulnerability exists in Open ISES Tickets versions prior to 3.44.2. The flaw is located in 'os_watch.php', where the 'ref' and 'mode_orig' POST parameters are not properly sanitized before being rendered into the value attributes of hidden HTML form inputs. An authenticated attacker can exploit this by crafting a malicious request that, when processed by a victim's browser, executes arbitrary JavaScript in the context of the victim's session. This vulnerability was addressed in version 3.44.2 by implementing input sanitization using htmlspecialchars() with ENT_QUOTES.

## Affected products

- Open ISES Tickets < 3.44.2

## Timeline

- 2026-04-01: patched: Fix committed to repository
- 2026-04-02: advisory: Release v3.44.2 published
- 2026-05-21: disclosed: CVE-2026-48226 published

## References

- [https://github.com/openises/tickets/commit/ecfeb406a016766cae81c749e14b5145a9f2dbff](https://github.com/openises/tickets/commit/ecfeb406a016766cae81c749e14b5145a9f2dbff)
- [https://github.com/openises/tickets/releases/tag/v3.44.2](https://github.com/openises/tickets/releases/tag/v3.44.2)
- [https://www.vulncheck.com/advisories/open-ises-tickets-reflected-xss-via-os-watch-php-ref-and-mode-orig-parameters](https://www.vulncheck.com/advisories/open-ises-tickets-reflected-xss-via-os-watch-php-ref-and-mode-orig-parameters)

## Related threats

- [Open ISES Tickets improper TLS certificate validation in mobile login](https://junglewise.ai/threats/cve-2026-48249-open-ises-tickets-improper-tls-certificate-validation-in-mobile)
- [Open ISES Tickets improper TLS certificate validation in login component](https://junglewise.ai/threats/cve-2026-48248-open-ises-tickets-improper-tls-certificate-validation-in-login)
- [Open ISES Tickets improper TLS certificate verification in functions.inc.php](https://junglewise.ai/threats/cve-2026-48247-open-ises-tickets-improper-tls-certificate-verification-in)
- [Open ISES Tickets improper TLS certificate validation in ajax/reports.php](https://junglewise.ai/threats/cve-2026-48246-open-ises-tickets-improper-tls-certificate-validation-in-ajax)
- [Open ISES Tickets hardcoded Google Maps API key in tables.php](https://junglewise.ai/threats/cve-2026-48245-open-ises-tickets-hardcoded-google-maps-api-key-in-tables-php)