OpenText Access Manager CVE-2026-11877

Q: What is the CVSS score of CVE-2026-11877?

CVE-2026-11877 has a CVSS 4.0 base score of 6.3 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-38792 MEDIUM

Incorrect Use of Privileged APIs (CWE-648)

2026-06-24 OpenText

GHSA-3frm-wcmv-8jx7

Authentication Bypass Access Manager

6.3

CVSS 4.0 · Vendor: OpenText

Severity by source

Vendor (OpenText) PRIMARY

6.3 MEDIUM

CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

5.4 MEDIUM

Network vector, no auth required per PR:N; AC:H reflects AT:P complexity; scope changed as downstream systems consuming IAM policies are affected; no confidentiality or availability impact.

3.1 AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N

4.0 AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (OpenText).

CVSS VectorVendor: OpenText

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 24, 2026 - 14:52 vuln.today

DescriptionCVE.org

An unauthorized user can modify configuration through API calls that affects the OpenText Access Manager. This issue affects Access Manager before 5.1.3.

AnalysisAI

Unauthorized configuration modification in OpenText Access Manager before 5.1.3 allows a remote unauthenticated attacker to alter system configuration via API calls that lack proper authorization enforcement, classified under CWE-648 (Incorrect Use of Privileged APIs). Affected deployments expose privileged API endpoints without adequate access control, enabling integrity impact across both the vulnerable system and subsequent systems relying on it for identity and access decisions. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.

Technical ContextAI

OpenText Access Manager (formerly NetIQ/Micro Focus Access Manager) is an enterprise Identity and Access Management (IAM) platform providing single sign-on, federation, and policy-based access control. The affected CPE (cpe:2.3:a:opentext:access_manager:*:*:*:*:*:*:*:*) covers all versions prior to 5.1.3. CWE-648 (Incorrect Use of Privileged APIs) identifies the root cause: the product exposes configuration-modifying API endpoints that should require elevated authorization but fail to enforce it, allowing any network-accessible caller to invoke them. The CVSS 4.0 vector (AV:N/AC:H/AT:P/PR:N/UI:N) indicates remote network exploitation without authentication, but with high attack complexity and a specific attack target precondition, suggesting that exploitation is not trivially repeatable against arbitrary instances without knowledge of the environment or a particular configuration state.

RemediationAI

Upgrade OpenText Access Manager to version 5.1.3 or later, as indicated by the fix boundary in the vulnerability description. The vendor advisory at https://portal.microfocus.com/s/article/KM000047450 should be consulted for official upgrade instructions and any additional guidance. If immediate patching is not feasible, restrict network access to the Access Manager administration and API interfaces using perimeter controls - specifically, limit API endpoint reachability to trusted management networks or VPN-only segments, as the AV:N vector requires network reachability. Additionally, review API access logs for unexpected configuration-modification calls from unauthenticated sources as a detection measure. Note that network-layer restriction is a compensating control only and does not address the underlying authorization defect.