Zenworks Service Desk CVE-2026-3278

Requires authenticated user account on OpenText ZENworks Service Desk 25.2 or 25.3. Attacker must craft malicious input in web form fields. Victim must view the generated web page containing the injected payload. Exploits improper input neutralization during page generation.

While CVSS and EPSS scores are not published, the vulnerability presents a significant real-world risk due to its classification as XSS in a service desk application—a system typically accessed by internal IT staff and end-users with varying privilege levels. XSS vulnerabilities in web applications are fundamentally automatable and require minimal attacker complexity, typically just crafted URL injection or form input. The affected versions (25.2 and 25.3) suggest recent releases, indicating a potentially large active user base. Without known public proof-of-concept or active exploitation data (KEV status unknown), this appears to be a pre-disclosure or early-stage advisory from the vendor. The practical risk is elevated because service desk platforms are often trusted targets for internal attacks and are frequently Internet-facing or accessible via VPN, making them attractive vectors for credential harvesting or privilege escalation.

An attacker crafts a malicious URL containing JavaScript payload and sends it to a service desk user via email or embeds it in a support ticket description. When the victim clicks the link or views the ticket within the ZENworks Service Desk web interface, the injected script executes in their browser session, stealing their authentication cookie or session token. The attacker then uses the stolen session to log in as the victim, access sensitive tickets, escalate privileges, or pivot to other internal systems.