{"id":"CVE-2026-76580","kind":"vulnerability","aliases":["CVE-2026-76580"],"related":[],"title":"OpenText Directory Services: cross-site scripting flaw lets attackers run scripts in browsers","description":"Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in OpenText OpenText Directory Services (OTDS) on Windows and Linux allows Cross-Site Scripting (XSS).\n\nThis issue affects OpenText Directory Services (OTDS): from 25.1 through 26.2.","summary":"OpenText Directory Services (OTDS) versions 25.1 through 26.2 on Windows and Linux fail to neutralize input in generated web pages, enabling cross-site scripting. An attacker can get script to run in a victim's browser session on the OTDS web interface.","severity":"medium","cvss":6.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["identity","linux","opentext","otds","vendor","windows"],"not_affected_if":["version-outside-25.1-26.2"],"how_to_check":"- Confirm whether OTDS is installed and note its version against the affected range `25.1` through `26.2`","fix":null,"status":"open","published_at":"2026-11-05T20:17:59+00:00","first_seen_at":"2026-11-05T20:40:46+00:00","triaged_at":"2026-11-05T20:43:23+00:00","updated_at":"2026-11-05T20:43:23+00:00","category":"vendor","confidence":0.5,"triage":{"at":"2026-11-05T20:43:23Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"OpenText Directory Services: cross-site scripting flaw lets attackers run scripts in browsers","impact":"medium","summary":"OpenText Directory Services (OTDS) versions 25.1 through 26.2 on Windows and Linux fail to neutralize input in generated web pages, enabling cross-site scripting. An attacker can get script to run in a victim's browser session on the OTDS web interface.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["opentext","otds","windows","linux","identity"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Script runs in a user's browser on the OTDS site","analyst_note":"Check the OpenText advisory for the fixed OTDS version, the vulnerable input field and whether authentication is required; the NVD entry alone gives no fix or details.","how_to_check":"- Confirm whether OTDS is installed and note its version against the affected range `25.1` through `26.2`\n- unknown for other checks","plain_action":"","needs_analyst":true,"not_affected_if":["version-outside-25.1-26.2"],"who_is_affected":"Organisations running OpenText Directory Services (OTDS) versions 25.1 through 26.2 on Windows or Linux are in scope. The sources do not say which OTDS features or configurations are needed to reach the vulnerable page, so whether a given deployment is exposed is unknown.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000697,"input_tokens":4230,"output_tokens":549,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':16A,19A '-76580':17A,20A '25.1':32B,107C '26.2':34B,109C 'affect':101C 'allow':93C 'attack':10A,53B 'browser':14A,63B 'cross':5A,49B,79C,95C 'cross-sit':4A,48B,78C,94C 'cve':15A,18A 'directori':2A,28B,86C,103C 'enabl':47B 'fail':39B 'flaw':8A 'generat':44B,77C 'get':55B 'ident':21B 'improp':70C 'input':42B,73C 'interfac':69B 'issu':100C 'let':9A 'linux':22B,38B,92C 'neutral':41B,71C 'opentext':1A,23B,27B,84C,85C,102C 'otd':24B,30B,67B,88C,105C 'page':46B,76C 'run':11A,58B 'script':7A,12A,51B,56B,81C,97C 'servic':3A,29B,87C,104C 'session':64B 'site':6A,50B,80C,96C 'vendor':25B 'version':31B 'victim':61B 'vulner':82C 'web':45B,68B,75C 'window':26B,36B,90C 'xss':98C","nicknames":[],"mitigations":[],"who_affected":"Organisations running OpenText Directory Services (OTDS) versions 25.1 through 26.2 on Windows or Linux are in scope. The sources do not say which OTDS features or configurations are needed to reach the vulnerable page, so whether a given deployment is exposed is unknown.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["identity","linux","medium","opentext","otds","vendor","windows"],"campaign_type":null,"first_public_at":"2026-11-05T20:17:59+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"security@opentext.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-76580","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-76580","severity":null,"published_at":"2026-11-05T20:17:59+00:00","modified_at":"2026-11-05T20:17:59+00:00","first_seen_at":"2026-11-05T20:40:46+00:00","fetched_at":"2026-11-05T20:40:46+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}