CVE-2026-76580 · Vendor
NO FIX YET
OpenText Directory Services (OTDS) versions 25.1 through 26.2 on Windows and Linux fail to neutralize input in generated web pages, enabling cross-site scripting. An attacker can get script to run in a victim's browser session on the OTDS web interface.
first public Nov 5, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Organisations running OpenText Directory Services (OTDS) versions 25.1 through 26.2 on Windows or Linux are in scope. The sources do not say which OTDS features or configurations are needed to reach the vulnerable page, so whether a given deployment is exposed is unknown.
Not affected if version-outside-25.1-26.2
Who cares identity, linux, opentext, otds, windows
25.1 through 26.2No fix yet, per the sources.
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in OpenText OpenText Directory Services (OTDS) on Windows and Linux allows Cross-Site Scripting (XSS).
This issue affects OpenText Directory Services (OTDS): from 25.1 through 26.2.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.