6
CVEs
0
Critical
4
High
0
KEV
0
PoC
4
Unpatched C/H
16.7%
Patch Rate
0.2%
Avg EPSS
Severity Breakdown
CRITICAL
0
HIGH
4
MEDIUM
2
LOW
0
Monthly CVE Trend
Affected Products (29)
Brava Desktop
35
Documentum Content Server
8
Vertica
6
Documentum Webtop
6
Document Sciences Xpression
6
Exceed Ondemand
4
Documentum Administrator
4
Web Site Management Server
3
Documentum D2
3
Arcsight Intelligence
3
Brava
2
Open Redirect
2
Xm Fax
2
Filr
2
Access Manager
2
Operations Agent
1
Directory Services
1
Content Server
1
Opentext Ixos Ecm For Sap Netweaver
1
Tomcat
1
PostgreSQL
1
Zenworks Service Desk
1
Tempo Box
1
Alm Octane
1
Identity Manager
1
Idm Driver And Extensions
1
Secure Mft 2014
1
Java
1
Secure Mft 2013
1
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-2123 | Privilege escalation in OpenText Operations Agent versions 12.29 and earlier on Windows allows local attackers to execute arbitrary code by placing malicious executables in specific writeable directories, which the agent subsequently executes with elevated privileges. The vulnerability requires local access and specific conditions to be present but does not require prior authentication to the agent itself. No public exploit code has been identified, and there is no confirmation of active exploitation at time of analysis. | HIGH | 8.6 | 0.0% | 43 |
No patch
|
| CVE-2025-13478 | OpenText Identity Manager versions up to 25.2 (v4.10.1) suffer from insecure cache handling that permits remote authenticated users to retrieve another user's session data, resulting in unauthorized information disclosure. An attacker with valid credentials can exploit this cache misconfiguration on both Windows and Linux deployments to access sensitive session information belonging to other authenticated users, compromising confidentiality of user sessions and potentially enabling lateral movement or privilege escalation attacks. | HIGH | 8.4 | 0.2% | 42 |
No patch
|
| CVE-2026-11878 | Cross-site scripting in OpenText Access Manager 5.1 through 5.1.2 lets a remote unauthenticated attacker inject script that executes in the browser of a targeted user of this enterprise SSO/access-management platform (CWE-79). Per the vendor-supplied CVSS 4.0 vector the flaw carries high vulnerable-system confidentiality impact (VC:H) but high attack complexity and a specific attack requirement (AC:H/AT:P), yielding a base score of 8.2. No public exploit identified at time of analysis and it is not listed in CISA KEV. | HIGH | 8.2 | 0.2% | 41 |
No patch
|
| CVE-2024-11604 | Insertion of Sensitive Information into Log File vulnerability in the SCIM Driver module in OpenText IDM Driver and Extensions on Windows, Linux, 64 bit allows authenticated local users to obtain. Rated high severity (CVSS 7.3), this vulnerability is low attack complexity. No vendor patch available. | HIGH | 7.3 | 0.0% | 37 |
No patch
|
| CVE-2026-11877 | Unauthorized configuration modification in OpenText Access Manager before 5.1.3 allows a remote unauthenticated attacker to alter system configuration via API calls that lack proper authorization enforcement, classified under CWE-648 (Incorrect Use of Privileged APIs). Affected deployments expose privileged API endpoints without adequate access control, enabling integrity impact across both the vulnerable system and subsequent systems relying on it for identity and access decisions. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV. | MEDIUM | 6.3 | 0.2% | 32 |
No patch
|
| CVE-2025-3271 | Cross-site scripting in OpenText Documentum Webtop versions prior to 16.7.1 allows an authenticated attacker to inject malicious scripts into the application that execute in a victim user's browser upon interaction with attacker-controlled content. The CVSS 4.0 vector (PR:L/UI:A) confirms exploitation requires both a valid account and active victim engagement, constraining the realistic attack surface to insider threats or compromised accounts. No public exploit code or active exploitation has been identified at time of analysis. | MEDIUM | 4.8 | 0.3% | 24 |
|