OpenText Access Manager CVE-2026-11877

The CVSS 4.0 vector specifies PR:N (no authentication required) and AV:N (network reachable), meaning the vulnerable API endpoint must be accessible over the network without credentials. However, AC:H and AT:P impose meaningful constraints: the attack requires high complexity and targets a specific precondition or system state - exact precondition is not detailed in the description, but likely involves knowledge of specific API endpoint paths or a particular configuration mode of the Access Manager deployment. Exploitation is limited by: (1) the AT:P specific-target requirement, making mass/automated exploitation unlikely; (2) AC:H, indicating a non-trivial exploitation path; (3) the impact being configuration integrity only, with no direct credential theft or code execution. Organizations with Access Manager API interfaces exposed to untrusted networks face the highest exposure.

The vendor-assigned CVSS 4.0 score of 6.3 (Medium) reflects a limited but real integrity risk. The AV:N/PR:N combination is concerning for an IAM product - unauthorized remote configuration changes could undermine access policies enforced downstream. However, AC:H and AT:P meaningfully constrain real-world exploitability: these metrics indicate high attack complexity and a requirement for a specific attack target or precondition, implying exploitation is not mass-automatable. Impact is bounded: VC:N/VA:N with only VI:L and SC:L/SI:L means confidentiality is not directly breached, and availability is unaffected. For an IAM system, even low-integrity changes to configuration can have outsized downstream effects on access control decisions, so defenders should weight the functional risk higher than the raw score implies. No EPSS data is provided; no KEV listing; no POC identified - this is a patch-priority but not an emergency-response trigger for most organizations. CVSS indicates PR:N (unauthenticated), but AT:P tempers the exploitability assessment - the real-world attack surface is narrower than a simple PR:N/AV:N reading would suggest.

An attacker with network access to the OpenText Access Manager API interface - but without any credentials - crafts a specific API request targeting a configuration endpoint that lacks authorization enforcement. By exploiting the missing privilege check (CWE-648), the attacker modifies system configuration, potentially altering access policies, redirecting authentication flows, or weakening access controls that downstream applications depend on. No public exploit code has been identified, but the attack is conceptually straightforward for an attacker familiar with the Access Manager API structure and meeting the AT:P precondition.