OpenText vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Latest high and critical flaws

• CVE-2026-75120 The OpenText™ (EnCase SAFE Agents) component utilized by OpenText™ Endpoint Investigator, OpenText™ Endpoint Forensics & Response, OpenText™ Information AssuranCritical 9.3 · Oct 13, 2026
• CVE-2026-12559 A Stored Cross-Site Scripting (XSS) vulnerability has been identified in OpenText Vendor Invoice Management for SAP Solutions Capture Validation application.High 7.3 · Sep 24, 2026
• CVE-2026-13202 A vulnerability in OpenText Opentext Directory Services allows Input Data Manipulation.High 7.3 · Aug 17, 2026
• CVE-2026-11878 Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in OpenText Access Manager allows Cross-Site Scripting (XSS).High 8.2 · Jun 24, 2026
• CVE-2025-15610 The .NET Remoting framework used by OpenText Fax (RightFax) includes known security vulnerabilities that could be exploited if the service is exposed in environCritical 9.3 · Apr 15, 2026
• CVE-2026-2123 A security audit identified a privilege escalation vulnerability in Operations Agent(<=OA 12.29) on Windows.High 8.6 · Mar 31, 2026
• CVE-2024-11604 Insertion of Sensitive Information into Log File vulnerability in the SCIM Driver module in OpenText IDM Driver and Extensions on Windows, Linux, 64 bit allows High 7.3 · Mar 27, 2026
• CVE-2025-13478 Cache misconfiguration vulnerability in OpenText Identity Manager on Windows, Linux allows remote authenticated users to obtain another user's session data via High 8.4 · Mar 27, 2026
• CVE-2026-3278 Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in OpenText™ ZENworks Service Desk allows Cross-Site ScriptinHigh 7.4 · Mar 18, 2026
• CVE-2026-3266 Missing Authorization vulnerability in OpenText™ Filr allows Authentication Bypass.High 8.3 · Mar 3, 2026
• CVE-2025-9120 Improper Control of Generation of Code ('Code Injection') vulnerability in OpenText™ Carbonite Safe Server Backup allows Code Injection.High 8.6 · Feb 23, 2026
• CVE-2025-9208 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in OpenText™ Web Site Management Server allows Stored High 7.5 · Feb 19, 2026
• CVE-2025-8054 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in OpenText™ XM Fax allows Path Traversal.High 7.1 · Feb 19, 2026
• CVE-2025-13672 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in OpenText™ Web Site Management Server allows ReflectHigh 7 · Feb 19, 2026
• CVE-2025-15579 Deserialization of Untrusted Data vulnerability in OpenText™ Directory Services allows Object Injection.Critical 9.5 · Feb 18, 2026
• CVE-2025-5808 Improper Input Validation vulnerability in OpenText Self Service Password Reset allows Authentication Bypass.This issue affects Self Service Password Reset fromHigh 7.3 · Aug 29, 2025
• CVE-2025-3478 A Stored Cross-Site Scripting (XSS) vulnerability has been identified in OpenText Enterprise Security Manager.High 8.5 · Aug 25, 2025
• CVE-2024-10865 Improper Input validation leads to XSS or Cross-site Scripting vulnerability in OpenText Advanced Authentication.Critical 9.4 · May 14, 2025
• CVE-2024-10864 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in OpenText Advanced Authentication.High 7.5 · May 14, 2025
• CVE-2025-3476 Incorrect Authorization vulnerability in OpenText™ Operations Bridge Manager.Critical 9.4 · May 7, 2025
• CVE-2024-12530 Uncontrolled Search Path Element vulnerability in OpenText Secure Content Manager on Windows allows DLL Side-Loading.This issue affects Secure Content Manager: High 7 · Apr 17, 2025
• CVE-2022-26323 Incorrect Use of Privileged APIs vulnerability in OpenText™ Operations Bridge Manager, OpenText™ Operations Bridge Suite (Containerized), OpenText™ UCMDB ( ClasHigh 8.7 · Apr 17, 2025
• CVE-2025-0884 Unquoted Search Path or Element vulnerability in OpenText™ Service Manager.High 7.3 · Mar 12, 2025
• CVE-2024-12799 Insufficiently Protected Credentials vulnerability in OpenText Identity Manager Advanced Edition on Windows, Linux, 64 bit allows Privilege Abuse.Critical 10 · Mar 5, 2025
• CVE-2024-7085 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in OpenText™ Solutions Business Manager (SBM) allows SHigh 8.2 · Jan 15, 2025