EnCase SAFE Agents EUVD-2026-99206

Exploitation requires network reachability to an EnCase SAFE Agent endpoint and the ability to initiate a session with it; the flaw lies in the session-establishment phase, where intended security controls are bypassed to create an unauthorized/unauthenticated connection (CWE-290). Per the CVSS vector (AV:N/AC:L/PR:N/UI:N/AT:N) there is no special configuration, authentication, or user-interaction prerequisite stated, so default deployments exposing the agent's listening interface are at risk. The practical limiting factor is exposure scope: agents reachable only on hardened, segmented management networks are far less exposed than those reachable from untrusted networks. Affected products are OpenText Endpoint Investigator, Endpoint Forensics & Response, Information Assurance, and Endpoint Security that embed the SAFE Agents component.

This is a genuine high-priority issue, not merely a high-CVSS paper tiger. The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H, 9.3) describes a fully remote, low-complexity, unauthenticated authentication bypass (CWE-290, Authentication Bypass by Spoofing) in the EnCase SAFE Agents that yields high confidentiality, integrity, and availability impact on the agent. The security significance is amplified by the nature of the product: these agents are a forensic/DFIR control plane with deep endpoint access, so an unauthorized session is high-value. However, no EPSS score, no CISA KEV listing, and no public POC were provided, so there is currently no evidence of active exploitation or widespread automated attacks - the severity rests on the vulnerability's intrinsic characteristics rather than observed in-the-wild activity. The only reference is the OpenText support KB advisory; NVD enrichment, EPSS, and independent corroboration are absent. Net: treat as urgent-to-patch due to unauthenticated remote access to a privileged forensic agent, while recognizing that exploitation-likelihood signals (EPSS/KEV/POC) are simply missing rather than low.

A remote attacker with network reachability to an exposed EnCase SAFE Agent initiates a session and bypasses the intended session-establishment security controls, authenticating as a trusted party without valid credentials. Having established an unauthorized connection to the privileged forensic agent, the attacker can leverage the agent's endpoint access to read, alter, or disrupt operations. No public exploit identified at time of analysis, and no user interaction is required per the CVSS vector.