---
id: "CVE-2026-76580"
kind: "vulnerability"
aliases: ["CVE-2026-76580"]
title: "OpenText Directory Services: cross-site scripting flaw lets attackers run scripts in browsers"
severity: "medium"
cvss: 6.3
epss: null
exploited: false
status: "open"
category: "vendor"
products: []
ecosystems: []
tags: ["identity", "linux", "opentext", "otds", "vendor", "windows"]
not_affected_if: ["version-outside-25.1-26.2"]
published_at: "2026-11-05T20:17:59+00:00"
first_seen_at: "2026-11-05T20:40:46+00:00"
updated_at: "2026-11-05T20:43:23+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-76580", "first_seen_at": "2026-11-05T20:40:46+00:00"}]
exploit_sources: []
---

# OpenText Directory Services: cross-site scripting flaw lets attackers run scripts in browsers

OpenText Directory Services (OTDS) versions 25.1 through 26.2 on Windows and Linux fail to neutralize input in generated web pages, enabling cross-site scripting. An attacker can get script to run in a victim's browser session on the OTDS web interface.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Confirm whether OTDS is installed and note its version against the affected range `25.1` through `26.2`

## Timeline

- 2026-11-05T20:40:46+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-76580

## From the sources

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in OpenText OpenText Directory Services (OTDS) on Windows and Linux allows Cross-Site Scripting (XSS).

This issue affects OpenText Directory Services (OTDS): from 25.1 through 26.2.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_