Which versions of OpenText Access Manager are affected by CVE-2026-11878?

Exploitation of this OpenText Access Manager vulnerability allows unauthenticated attackers to hijack user sessions within the organization's centralized authentication platform, potentially…

How to fix or mitigate CVE-2026-11878?

Within 24 hours: Verify deployment of OpenText Access Manager versions 5.1 through 5.1.2 in production environments and assess the scope of dependent applications. Within 7 days: Implement web application firewall rules to block injection attacks; restrict network access to the authentication platform; enable comprehensive logging of authentication events. Within 30 days: Establish a patch evaluation and deployment schedule; monitor vendor security advisories for remediated versions.

OpenText Access Manager CVE-2026-11878

Q: What is the CVSS score of CVE-2026-11878?

CVE-2026-11878 has a CVSS 4.0 base score of 8.2 (High). CVSS vector: CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-38791 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-06-24 OpenText

GHSA-rrp3-3f6h-33jr

XSS Access Manager Opentext

8.2

CVSS 4.0 · Vendor: OpenText

Severity by source

Vendor (OpenText) PRIMARY

8.2 HIGH

CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

4.7 MEDIUM

Reflected XSS reachable over the network without auth (PR:N) but needing a victim to open crafted content (UI:R) and non-trivial preconditions (AC:H); script runs cross-context (S:C) with limited C/I impact.

3.1 AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:H/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (OpenText).

CVSS VectorVendor: OpenText

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 24, 2026 - 14:52 vuln.today

DescriptionCVE.org

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in OpenText Access Manager allows Cross-Site Scripting (XSS).

This issue affects Access Manager: from 5.1 through 5.1.2.

AnalysisAI

Cross-site scripting in OpenText Access Manager 5.1 through 5.1.2 lets a remote unauthenticated attacker inject script that executes in the browser of a targeted user of this enterprise SSO/access-management platform (CWE-79). Per the vendor-supplied CVSS 4.0 vector the flaw carries high vulnerable-system confidentiality impact (VC:H) but high attack complexity and a specific attack requirement (AC:H/AT:P), yielding a base score of 8.2. No public exploit identified at time of analysis and it is not listed in CISA KEV.

Technical ContextAI

OpenText Access Manager (formerly NetIQ/Micro Focus Access Manager) is an enterprise identity federation, single sign-on, and reverse-proxy access-gateway product used to broker authentication to web applications. The root cause is CWE-79, improper neutralization of user-controllable input during web page generation: data reaching one of the product's web interfaces (e.g. the Identity Server, Administration Console, or Access Gateway portal pages) is reflected or stored without adequate output encoding, so an attacker-supplied string is interpreted as active script by the victim's browser. The single CPE provided, cpe:2.3:a:opentext:access_manager:*:*:*:*:*:*:*:*, identifies the application but does not narrow the affected component; the description and CVSS scope-change signal (SC:L) indicate the impact crosses into the authenticated user's session context rather than staying confined to the injection point.

RemediationAI

Consult the OpenText/Micro Focus advisory at https://portal.microfocus.com/s/article/KM000047449 for the vendor-released fixed build and upgrade to the patched release for the 5.1 line (an exact fix version was not present in the available input and should be confirmed from that KB article before scheduling - do not assume a version number). Patch available per vendor advisory; until it is applied, reduce exposure by placing the Identity Server and Administration Console behind network restrictions so only trusted management networks can reach them, and consider a WAF or reverse-proxy rule that strips or encodes script-bearing parameters on the affected endpoints - trade-off being possible false positives that block legitimate query strings. Enforcing a strict Content-Security-Policy and HttpOnly session cookies on Access Manager portals further limits the impact of any residual injection, with the side effect that custom branding or inline scripts may need adjustment.