OpenText vulnerabilities
We track 75 vulnerabilities in OpenText products across 55 products. 75 are rated high or critical, and none are known to be exploited. The most recent was published on November 9, 2026.
Latest OpenText vulnerabilities
- 8.3 High severity
OpenText Directory Services: Improper Authentication
Improper Authentication vulnerability in OpenText OpenText Directory Services may allow Multi-factor Authentication Bypass in particular scenarios.This issue affects OpenText Directory Services: 24.2.
- 9.8 Critical severity
iManager: Improper Restriction of XML External Entity Reference
XML External Entity injection vulnerability found in OpenText™ iManager 3.2.6.0200. This could lead to remote code execution by parsing untrusted XML payload
- 8.8 High severity
Dimensions RM: Improper Authentication
Privilege Escalation in OpenText Dimensions RM allows an authenticated user to escalate there privilege to the privilege of another user via HTTP Request
- 8.7 High severity
ArcSight Enterprise Security Manager: Improper Neutralization of Input During Web Page Generation
A Stored Cross-Site Scripting (XSS) vulnerability has been identified in OpenText ArcSight Enterprise Security Manager and ArcSight Platform. The vulnerability could be remotely exploited.
- 8.7 High severity
ArcSight Enterprise Security Manager: Improper Neutralization of Input During Web Page Generation
A Stored Cross-Site Scripting (XSS) vulnerability has been identified in OpenText ArcSight Enterprise Security Manager and ArcSight Platform. The vulnerability could be remotely exploited.
- 7.5 High severity
iManager: Server-Side Request Forgery
Server Side Request Forgery vulnerability has been discovered in OpenText™ iManager 3.2.6.0200. This could lead to senstive information disclosure by directory traversal.
- 9.8 Critical severity
Remote Code Execution has been discovered in OpenText™ iManager 3.2.6.0200.
Remote Code Execution has been discovered in OpenText™ iManager 3.2.6.0200. The vulnerability can trigger remote code execution using custom file upload task.
- 9.8 Critical severity
iManager: Deserialization of Untrusted Data
Remote Code Execution has been discovered in OpenText™ iManager 3.2.6.0200. The vulnerability can trigger remote code execution unisng unsafe java object deserialization.
- 9.8 Critical severity
iManager: Unrestricted Upload of File with Dangerous Type
File Upload vulnerability in unauthenticated session found in OpenText™ iManager 3.2.6.0200. The vulnerability could allow ant attacker to upload a file without authentication.
- 9.8 Critical severity
iManager: Improper Authentication
Broken Authentication vulnerability discovered in OpenText™ iManager 3.2.6.0200. This vulnerability allows an attacker to manipulate certain parameters to bypass authentication.
- 9.8 Critical severity
iManager: Improper Restriction of XML External Entity Reference
XML External Entity injection vulnerability found in OpenText™ iManager 3.2.6.0200. This could lead to information disclosure and remote code execution.
- 9.8 Critical severity
iManager: Improper Neutralization of Special Elements used in a Command
Remote Code Execution has been discovered in OpenText™ iManager 3.2.6.0200. The vulnerability can trigger command injection and insecure deserialization issues.
- 8.7 High severity
ArcSight Management Center: Improper Neutralization of Input During Web Page Generation
A Stored Cross-Site Scripting (XSS) vulnerability has been identified in OpenText ArcSight Management Center and ArcSight Platform. The vulnerability could be remotely exploited.
- 7.4 High severity
ZENworks Configuration Management (ZCM): Incorrect Authorization
Incorrect Authorization vulnerability in OpenText™ ZENworks Configuration Management (ZCM) allows Unauthorized Use of Device Resources.This issue affects ZENworks Configuration Management (ZCM) versions: 2020 update 3, 23.3, and 23.4.
- 8.5 High severity
Secure Content Manager: Improper Privilege Management
By leveraging the vulnerability, lower-privileged users of Content Manager can manipulate Content Manager clients to elevate privileges and perform unauthorized operations.
- 9.8 Critical severity
Certain functionality in OpenText Vertica Management console might be prone to bypass via…
Certain functionality in OpenText Vertica Management console might be prone to bypass via crafted requests. The vulnerability would affect one of Vertica’s authentication functionalities by allowing specially crafted requests and sequences. This issue impacts
- 9.8 Critical severity
Exceed Turbo X: Use of Hard-coded Credentials
Use of Hard-coded Cryptographic Key vulnerability in OpenText™ Exceed Turbo X affecting versions 12.5.1 and 12.5.2. The vulnerability could compromise the cryptographic keys.
- 7.5 High severity
Exceed Turbo X: Improper Authentication
Improper authentication vulnerability in OpenText™ Exceed Turbo X affecting versions 12.5.0 and 12.5.1. The vulnerability could allow disclosure of restricted information in unauthenticated RPC.
- 7.8 High severity
NetIQ Client Login Extension: Authorization Bypass Through User-Controlled Key
Authorization Bypass Through User-Controlled Key vulnerability in NetIQ (OpenText) Client Login Extension on Windows allows Privilege Escalation, Code Injection.This issue only affects NetIQ Client Login Extension: 4.6.
- 7.8 High severity
Operations Agent: Improper Privilege Management
Local privilege escalation vulnerability affects OpenText Operations Agent product versions 12.15 and 12.20-12.25 when installed on Non-Windows platforms. The vulnerability could allow local privilege escalation.
- 7.1 High severity
Improper Input Validation vulnerability in OpenText AppBuilder on Windows, Linux allows Probe…
Improper Input Validation vulnerability in OpenText AppBuilder on Windows, Linux allows Probe System Files. An authenticated AppBuilder user with the ability to create or manage existing databases can leverage them to exploit the AppBuilder server - including
- 8.8 High severity
Improper Input Validation vulnerability in OpenText AppBuilder on Windows, Linux allows OS…
Improper Input Validation vulnerability in OpenText AppBuilder on Windows, Linux allows OS Command Injection. The AppBuilder's Scheduler functionality that facilitates creation of scheduled tasks is vulnerable to command injection. This allows authenticated us
- 7.5 High severity
AppBuilder: Files or Directories Accessible to External Parties
Improper Input Validation, Files or Directories Accessible to External Parties vulnerability in OpenText AppBuilder on Windows, Linux allows Probe System Files. An unauthenticated or authenticated user can abuse a page of AppBuilder to read arbitrary files on
- 9.8 Critical severity
Fortify ScanCentral DAST: Incorrect Privilege Assignment
Incorrect Privilege Assignment vulnerability in opentext Fortify ScanCentral DAST. The vulnerability could be exploited to gain elevated privileges.This issue affects Fortify ScanCentral DAST versions 21.1, 21.2, 21.2.1, 22.1, 22.1.1, 22.2, 23.1.
- 9.8 Critical severity
Visual COBOL, COBOL Server, Enterprise…: Improper Authentication
User authentication with username and password credentials is ineffective in OpenText (Micro Focus) Visual COBOL, COBOL Server, Enterprise Developer, and Enterprise Server (including product variants such as Enterprise Test Server), versions 7.0 patch updates
- 7.1 High severity
Archive Center Administration: Improper Restriction of XML External Entity Reference
The client in OpenText Archive Center Administration through 21.2 allows XXE attacks. Authenticated users of the OpenText Archive Center Administration client (Versions 16.2.3, 21.2, and older versions) could upload XML files to the application that it did not
- 7.8 High severity
Documentum Content Server: Incorrect Permission Assignment for Critical Resource
OpenText Documentum Content Server before 23.2 has a flaw that allows for privilege escalation from a non-privileged Documentum user to root. The software comes prepackaged with a root owned SUID binary dm_secure_writer. The binary has security controls in pla
- 9.8 Critical severity
Bizmanager: Improper Authentication
OpenText BizManager before 16.6.0.1 does not perform proper validation during the change-password operation. This allows any authenticated user to change the password of any other user, including the Administrator account.
- 8.8 High severity
Opentext Extended Ecm: Authorization Bypass Through User-Controlled Key
An issue was discovered in OpenText Content Suite Platform 22.1 (16.2.19.1803). The Java application server can be used to bypass the authentication of the QDS endpoints of the Content Server. These endpoints can be used to create objects and execute arbitrary
- 8.8 High severity
Opentext Extended Ecm: Deserialization of Untrusted Data
An issue was discovered in OpenText Content Suite Platform 22.1 (16.2.19.1803). The Common Gateway Interface (CGI) program cs.exe allows an attacker to increase/decrease an arbitrary memory address by 1 and trigger a call to a method of a vftable with a vftabl
- 8.8 High severity
Opentext Extended Ecm: Improper Control of Generation of Code
A remote OScript execution issue was discovered in OpenText Content Suite Platform 22.1 (16.2.19.1803). Multiple endpoints allow the user to pass the parameter htmlFile, which is included in the HTML output rendering pipeline of a request. Because the Content
- 8.8 High severity
Opentext Extended Ecm: Server-Side Request Forgery
An issue was discovered in OpenText Content Suite Platform 22.1 (16.2.19.1803). The endpoint notify.localizeEmailTemplate allows a low-privilege user to evaluate webreports.
- 7.5 High severity
Opentext Extended Ecm: Exposure of Sensitive Information to an Unauthorized Actor
An issue was discovered in OpenText Content Suite Platform 22.1 (16.2.19.1803). The action xmlexport accepts the parameter requestContext. If this parameter is present, the response includes most of the HTTP headers sent to the server and some of the CGI varia
- 8.1 High severity
Opentext Extended Ecm: Incorrect Default Permissions
An issue was discovered in OpenText Content Suite Platform 22.1 (16.2.19.1803). The endpoint itemtemplate.createtemplate2 allows a low-privilege user to delete arbitrary files on the server's local filesystem.
- 8.8 High severity
Opentext Extended Ecm: Improper Authentication
An issue was discovered in OpenText Content Suite Platform 22.1 (16.2.19.1803). The request handler for ll.KeepAliveSession sets a valid AdminPwd cookie even when the Web Admin password was not entered. This allows access to endpoints, which require a valid Ad