OpenText Access Manager EUVD-2026-38791

Exploitation targets the web interface of OpenText Access Manager 5.1 through 5.1.2 and requires no attacker authentication (PR:N) and network reach (AV:N), but it is meaningfully limited: the vendor vector sets AC:H (high attack complexity) and AT:P (a specific attack requirement/precondition must hold), indicating the injection is not reliably triggerable against arbitrary default requests and likely depends on a particular request path, parameter, or product configuration. Although the vector states UI:N, XSS impact is realized only when a victim renders the malicious content, so in practice a targeted user must visit the affected page - this user-dependence and the AT:P precondition are the principal factors that constrain real-world exploitation. The exact triggering feature or endpoint is not enumerated in the available data and should be confirmed from the OpenText advisory.

Signals are mixed and warrant a measured priority. The vendor CVSS 4.0 base of 8.2 is driven mainly by VC:H (high confidentiality impact) combined with network reach and no privileges, but it is tempered by AC:H and AT:P, meaning successful exploitation depends on elevated attack complexity and a specific precondition rather than a trivial drive-by. No EPSS score, KEV listing, POC, or SSVC decision data was provided, so there is no evidence of active or automated exploitation - this reads as a high-CVSS issue without corroborating real-world-exploitation signals. Note also an internal tension worth verifying: the vector lists UI:N for what is classified as XSS, yet most reflected XSS requires victim interaction; if exploitation in fact needs a user to open a crafted link, real-world risk is lower than the unqualified score implies. Because Access Manager is an authentication chokepoint, a confirmed XSS against an administrator or federated user is still meaningful (potential session/token theft), so treat as a prompt-but-not-emergency patch.

An attacker crafts a request or link containing a malicious script payload targeting a vulnerable Access Manager web page and lures or waits for a privileged user (such as an administrator or federated SSO user) to trigger it, given the AC:H/AT:P preconditions. When the page renders the unsanitized input, the script runs in the victim's session and can exfiltrate session tokens or authentication data (VC:H). No public exploit identified at time of analysis, so this scenario is inferred from the CVSS vector and CWE rather than demonstrated code.