Vendor Invoice Management EUVD-2026-86008

Exploitation is limited to the OpenText Vendor Invoice Management for SAP Solutions Capture Validation application and, per the CVSS vector, requires high-privilege authenticated access (PR:H) to store the payload plus victim user interaction (UI:P - the target must open the affected view). The vendor also qualifies it with 'under certain conditions,' indicating an unspecified application state is needed to trigger execution. These factors - privileged insider or compromised privileged account, victim interaction, and a specific triggering condition - substantially constrain realistic exploitation despite the network attack vector; there is no unauthenticated path in default configurations.

This is a moderate-priority, config-and-privilege-gated stored XSS rather than a widespread emergency. The vendor-supplied CVSS 4.0 vector (7.3) is network-facing (AV:N/AC:L) but critically requires high privileges (PR:H) and passive user interaction (UI:P), and explicitly marks exploit maturity as Unproven (E:U). No EPSS score is provided, there is no CISA KEV listing, and no public POC was identified - all three signals point to low near-term exploitation likelihood, consistent with the E:U rating. The vector's high impact ratings (VC:H/VI:H plus subsequent-system SC:H/SI:H/SA:H) are aggressive for a stored XSS; those subsequent-system 'H' values are what drive the 7.3, but classic stored XSS in a web app typically yields limited confidentiality/integrity impact scoped to the victim's session, so I assess the true impact lower (see assessed vector). The description hedges with 'under certain conditions,' meaning even the PR:H attacker needs an unspecified state to trigger it. Net: real but not urgent - patch on a normal cycle; the PR:H barrier means a malicious or compromised privileged insider is the realistic threat, not an internet-wide unauthenticated attacker.

A privileged user (or an attacker who has compromised such an account) stores a malicious script payload in a field processed by the Capture Validation application of OpenText VIM for SAP. When another user - such as an approver reviewing the invoice record - opens the affected view, the script executes in their browser session, enabling theft of session data or actions taken as that user. No public exploit code exists and the vendor rates exploit maturity as Unproven, so this remains theoretical at time of analysis.