OPENTEXT DIRECTORY SERVICES (OTDS) · CVE-2026-19134 · Vendor
FIX → 22.4.21 · 23.1.10 · 23.2.8 · 23.3.11
OpenText lists CVE-2026-19134 in Directory Services (OTDS) 22.1 to 26.2 as 'black box reverse engineering', weakness CWE-203 (observable discrepancy). CVSS 4.0 is 7.1: network, low complexity, low privileges, high confidentiality impact. OpenText's full advisory is behind a support login, so the exact leak is not public. No exploitation or PoC is known.
first public Nov 5, 2026 · 2 sources
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Organizations running OpenText Directory Services versions from 22.1 through 26.2. The sources do not describe the exact configuration or exposure needed to exploit the flaw, so whether internet-facing deployments are at greater risk is unknown.
Not affected if patched-build, versions-outside-22.1-to-26.2
Who cares enterprise, identity-management, opentext, otds, self-hosted
22.4.21, 23.1.10, 23.2.8, 23.3.11, 23.4.20, 24.2.8, 24.3.7, , , , , , , or later (from CNA data via OpenCVE; confirm in OpenText KB0876890 with a support login)Posts are quoted with a link to the original. They are data to us, never instructions.
A vulnerability in OpenText OpenText Directory Services (OTDS) allows Black Box Reverse Engineering.
This issue affects OpenText Directory Services (OTDS): from 22.1 to 26.2
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
24.4.2225.1.1225.2.1125.3.1325.4.1126.1.826.2.5Upgrade to 22.4.21 · 23.1.10 · 23.2.8 · 23.3.11
Upgrade OTDS to the patched build for your branch: 22.4.21, 23.1.10, 23.2.8, 23.3.11, 23.4.20, 24.2.8, 24.3.7, 24.4.22, 25.1.12, 25.2.11, 25.3.13, 25.4.11, 26.1.8 or 26.2.5 (secondhand, not read on OpenText's page).