Code injection in Micro Focus Network Operations Management Suite CDF
Priority MEDIUM 47CWE-94Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.0 · NVD. Fix status from CNA. Impact type from CWE-94.
Summary
Remote Code Execution in the following products Hybrid Cloud Management Containerized Suite HCM2017.11, HCM2018.02, HCM2018.05, Operations Bridge Containerized Suite 2017.11, 2018.02, 2018.05, Data Center Automation Containerized Suite 2017.01 until 2018.05, Service Management Automation Suite 2017.11, 2018.02, 2018.05, Service Virtualization (SV) with floating licenses using Any version using APLS older than 10.7, Unified Functional Testing (UFT) with floating licenses using Any version using APLS older than 10.7, Network Virtualization (NV) with floating licenses using Any version using APLS older than 10.7 and Network Operations Management (NOM) Suite CDF 2017.11, 2018.02, 2018.05 will allow Remote Code Execution.
Why it matters now
EPSS 0.02397 84th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Micro Focus | Network Operations Management (NOM) Suite CDF | 2017.11, 2018.02, 2018.05 | — | No fix listed | CNA |
| Micro Focus | Service Management Automation Suite | 2017.11, 2018.02, 2018.05 | — | No fix listed | CNA |
| Micro Focus | Data Center Automation Containerized Suite | 2017.01 until 2018.05 | — | No fix listed | CNA |
| Micro Focus | Operations Bridge Containerized Suite | 2017.11, 2018.02, 2018.05 | — | No fix listed | CNA |
| Micro Focus | Hybrid Cloud Management Containerized Suite | HCM2017.11, HCM2018.02, HCM2018.05 | — | No fix listed | CNA |
| Micro Focus | Network Virtualization (NV) with floating licenses | using Any version using APLS older than 10.7 | — | No fix listed | CNA |
| Micro Focus | Unified Functional Testing (UFT) with floating licenses | using Any version using APLS older than 10.7 | — | No fix listed | CNA |
| Micro Focus | Service Virtualization (SV) with floating licenses | using Any version using APLS older than 10.7 | — | No fix listed | CNA |
- Network Operations Management (NOM) Suite CDF VendorMicro Focus Affected 2017.11, 2018.02, 2018.05 Fixed in — No fix listed CNA
- Service Management Automation Suite VendorMicro Focus Affected 2017.11, 2018.02, 2018.05 Fixed in — No fix listed CNA
- Data Center Automation Containerized Suite VendorMicro Focus Affected 2017.01 until 2018.05 Fixed in — No fix listed CNA
- Operations Bridge Containerized Suite VendorMicro Focus Affected 2017.11, 2018.02, 2018.05 Fixed in — No fix listed CNA
- Hybrid Cloud Management Containerized Suite VendorMicro Focus Affected HCM2017.11, HCM2018.02, HCM2018.05 Fixed in — No fix listed CNA
- Network Virtualization (NV) with floating licenses VendorMicro Focus Affected using Any version using APLS older than 10.7 Fixed in — No fix listed CNA
- Unified Functional Testing (UFT) with floating licenses VendorMicro Focus Affected using Any version using APLS older than 10.7 Fixed in — No fix listed CNA
- Service Virtualization (SV) with floating licenses VendorMicro Focus Affected using Any version using APLS older than 10.7 Fixed in — No fix listed CNA
CPE configurations NVD · 26
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:microfocus:data_center_automation:2017.01:*:*:*:*:*:*:* | 2017.01 | Vulnerable | Micro Focus International |
| cpe:2.3:a:microfocus:data_center_automation:2017.05:*:*:*:*:*:*:* | 2017.05 | Vulnerable | Micro Focus International |
| cpe:2.3:a:microfocus:data_center_automation:2017.08:*:*:*:*:*:*:* | 2017.08 | Vulnerable | Micro Focus International |
| cpe:2.3:a:microfocus:data_center_automation:2017.09:*:*:*:*:*:*:* | 2017.09 | Vulnerable | Micro Focus International |
| cpe:2.3:a:microfocus:data_center_automation:2017.11:*:*:*:*:*:*:* | 2017.11 | Vulnerable | Micro Focus International |
| cpe:2.3:a:microfocus:data_center_automation:2018.02:*:*:*:*:*:*:* | 2018.02 | Vulnerable | Micro Focus International |
| cpe:2.3:a:microfocus:data_center_automation:2018.05:*:*:*:*:*:*:* | 2018.05 | Vulnerable | Micro Focus International |
| cpe:2.3:a:microfocus:hybrid_cloud_management:2017.11:*:*:*:premium:*:*:* | 2017.11 | Vulnerable | Micro Focus International |
| cpe:2.3:a:microfocus:hybrid_cloud_management:2017.11:*:*:*:ultimate:*:*:* | 2017.11 | Vulnerable | Micro Focus International |
| cpe:2.3:a:microfocus:hybrid_cloud_management:2018.02:*:*:*:premium:*:*:* | 2018.02 | Vulnerable | Micro Focus International |
- cpe:2.3:a:microfocus:data_center_automation:2017.01:*:*:*:*:*:*:* Versions 2017.01 Vulnerable ·Micro Focus International
- cpe:2.3:a:microfocus:data_center_automation:2017.05:*:*:*:*:*:*:* Versions 2017.05 Vulnerable ·Micro Focus International
- cpe:2.3:a:microfocus:data_center_automation:2017.08:*:*:*:*:*:*:* Versions 2017.08 Vulnerable ·Micro Focus International
- cpe:2.3:a:microfocus:data_center_automation:2017.09:*:*:*:*:*:*:* Versions 2017.09 Vulnerable ·Micro Focus International
- cpe:2.3:a:microfocus:data_center_automation:2017.11:*:*:*:*:*:*:* Versions 2017.11 Vulnerable ·Micro Focus International
- cpe:2.3:a:microfocus:data_center_automation:2018.02:*:*:*:*:*:*:* Versions 2018.02 Vulnerable ·Micro Focus International
- cpe:2.3:a:microfocus:data_center_automation:2018.05:*:*:*:*:*:*:* Versions 2018.05 Vulnerable ·Micro Focus International
- cpe:2.3:a:microfocus:hybrid_cloud_management:2017.11:*:*:*:premium:*:*:* Versions 2017.11 Vulnerable ·Micro Focus International
- cpe:2.3:a:microfocus:hybrid_cloud_management:2017.11:*:*:*:ultimate:*:*:* Versions 2017.11 Vulnerable ·Micro Focus International
- cpe:2.3:a:microfocus:hybrid_cloud_management:2018.02:*:*:*:premium:*:*:* Versions 2018.02 Vulnerable ·Micro Focus International
Show 16 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:microfocus:hybrid_cloud_management:2018.02:*:*:*:ultimate:*:*:* | 2018.02 | Vulnerable | Micro Focus International |
| cpe:2.3:a:microfocus:hybrid_cloud_management:2018.05:*:*:*:premium:*:*:* | 2018.05 | Vulnerable | Micro Focus International |
| cpe:2.3:a:microfocus:hybrid_cloud_management:2018.05:*:*:*:ultimate:*:*:* | 2018.05 | Vulnerable | Micro Focus International |
| cpe:2.3:a:microfocus:network_operations_management:2017.11:*:*:*:*:*:*:* | 2017.11 | Vulnerable | Micro Focus International |
| cpe:2.3:a:microfocus:network_operations_management:2018.02:*:*:*:*:*:*:* | 2018.02 | Vulnerable | Micro Focus International |
| cpe:2.3:a:microfocus:network_operations_management:2018.05:*:*:*:premium:*:*:* | 2018.05 | Vulnerable | Micro Focus International |
| cpe:2.3:a:microfocus:operations_bridge:2017.11:*:*:*:premium:*:*:* | 2017.11 | Vulnerable | Micro Focus International |
| cpe:2.3:a:microfocus:operations_bridge:2018.02:*:*:*:premium:*:*:* | 2018.02 | Vulnerable | Micro Focus International |
| cpe:2.3:a:microfocus:operations_bridge:2018.05:*:*:*:premium:*:*:* | 2018.05 | Vulnerable | Micro Focus International |
| cpe:2.3:a:microfocus:service_management_automation:2017.11:*:*:*:*:*:*:* | 2017.11 | Vulnerable | Micro Focus International |
| cpe:2.3:a:microfocus:service_management_automation:2018.02:*:*:*:*:*:*:* | 2018.02 | Vulnerable | Micro Focus International |
| cpe:2.3:a:microfocus:service_management_automation:2018.05:*:*:*:*:*:*:* | 2018.05 | Vulnerable | Micro Focus International |
| cpe:2.3:a:microfocus:network_virtualization:12.50:*:*:*:*:*:*:* | 12.50 | Vulnerable | Micro Focus International |
| cpe:2.3:a:microfocus:service_virtualization:1.00:*:*:*:*:*:*:* | 1.00 | Vulnerable | Micro Focus International |
| cpe:2.3:a:microfocus:unified_functional_testing:12.50:*:*:*:*:*:*:* | 12.50 | Vulnerable | Micro Focus International |
| cpe:2.3:a:microfocus:autopass_license_server:*:*:*:*:*:*:*:* | before 10.7.0 | Running on | Micro Focus International |
- cpe:2.3:a:microfocus:hybrid_cloud_management:2018.02:*:*:*:ultimate:*:*:* Versions 2018.02 Vulnerable ·Micro Focus International
- cpe:2.3:a:microfocus:hybrid_cloud_management:2018.05:*:*:*:premium:*:*:* Versions 2018.05 Vulnerable ·Micro Focus International
- cpe:2.3:a:microfocus:hybrid_cloud_management:2018.05:*:*:*:ultimate:*:*:* Versions 2018.05 Vulnerable ·Micro Focus International
- cpe:2.3:a:microfocus:network_operations_management:2017.11:*:*:*:*:*:*:* Versions 2017.11 Vulnerable ·Micro Focus International
- cpe:2.3:a:microfocus:network_operations_management:2018.02:*:*:*:*:*:*:* Versions 2018.02 Vulnerable ·Micro Focus International
- cpe:2.3:a:microfocus:network_operations_management:2018.05:*:*:*:premium:*:*:* Versions 2018.05 Vulnerable ·Micro Focus International
- cpe:2.3:a:microfocus:operations_bridge:2017.11:*:*:*:premium:*:*:* Versions 2017.11 Vulnerable ·Micro Focus International
- cpe:2.3:a:microfocus:operations_bridge:2018.02:*:*:*:premium:*:*:* Versions 2018.02 Vulnerable ·Micro Focus International
- cpe:2.3:a:microfocus:operations_bridge:2018.05:*:*:*:premium:*:*:* Versions 2018.05 Vulnerable ·Micro Focus International
- cpe:2.3:a:microfocus:service_management_automation:2017.11:*:*:*:*:*:*:* Versions 2017.11 Vulnerable ·Micro Focus International
- cpe:2.3:a:microfocus:service_management_automation:2018.02:*:*:*:*:*:*:* Versions 2018.02 Vulnerable ·Micro Focus International
- cpe:2.3:a:microfocus:service_management_automation:2018.05:*:*:*:*:*:*:* Versions 2018.05 Vulnerable ·Micro Focus International
- cpe:2.3:a:microfocus:network_virtualization:12.50:*:*:*:*:*:*:* Versions 12.50 Vulnerable ·Micro Focus International
- cpe:2.3:a:microfocus:service_virtualization:1.00:*:*:*:*:*:*:* Versions 1.00 Vulnerable ·Micro Focus International
- cpe:2.3:a:microfocus:unified_functional_testing:12.50:*:*:*:*:*:*:* Versions 12.50 Vulnerable ·Micro Focus International
- cpe:2.3:a:microfocus:autopass_license_server:*:*:*:*:*:*:*:* Versions before 10.7.0 Running on ·Micro Focus International
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2018-6499
- 2026-10-03 Alias added: GHSA-9gm2-7mpc-rwc6
References
Other 6
- https://softwaresupport.softwaregrp.com/document/-/facetsearch/document/KM03236722
- https://softwaresupport.softwaregrp.com/document/-/facetsearch/document/KM03236667
- https://softwaresupport.softwaregrp.com/document/-/facetsearch/document/KM03236669
- https://softwaresupport.softwaregrp.com/document/-/facetsearch/document/KM03236648
- https://softwaresupport.softwaregrp.com/document/-/facetsearch/document/KM03236632?lang=en&cc=us&hpappid=206728_SSO_PRO
- https://softwaresupport.softwaregrp.com/document/-/facetsearch/document/KM03236726
More Micro Focus vulnerabilities
- TI-2021-05471 OS command injection in Operation Bridge Reporter. KEVCVSS 3.1CRITICAL 9.8
- TI-2021-05475 Advance configuration exposing Information Leakage vulnerability in Micro Focus Access… KEVCVSS 3.1HIGH 7.5
- TI-2018-08950 Unauthenticated SQL injection in Micro Focus Secure Messaging Gateway CVSS 3.0CRITICAL 10.0
- TI-2020-09524 Hard-coded credentials in Micro Focus Application Performance Management CVSS 3.1CRITICAL 9.8
- TI-2018-08951 Remote Code Execution in Micro Focus Secure Messaging Gateway CVSS 3.0CRITICAL 9.1
- TI-2020-09523 Arbitrary code execution vulnerability on multiple Micro Focus products CVSS 3.1HIGH 8.8
Sources
- CVE-2018-6499 · CVE Program
- CVE-2018-6499 · NVD
- FIRST EPSS
- GHSA-9gm2-7mpc-rwc6 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences