Arbitrary File Upload in GroupWise Administration Console
Priority MEDIUM 44CWE-434Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- High
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.0 · CNA. Fix status from CNA. Impact type from CWE-434.
Summary
A vulnerability in the administration console of Micro Focus GroupWise prior to version 18.0.2 may allow a remote attacker authenticated as an administrator to upload files to an arbitrary path on the server. In certain circumstances this could result in remote code execution.
Why it matters now
EPSS 0.02232 82nd percentileScored 2026-11-07
Fix Fixed GroupWise (Micro Focus): 18.0.2
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Micro Focus | GroupWise | 2018 to before 18.0.2 | 18.0.2 | Patch available | CNA |
- GroupWise VendorMicro Focus Affected 2018 to before 18.0.2 Fixed in 18.0.2 Patch available CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:microfocus:groupwise:*:*:*:*:*:*:*:* | before 18.0.2 | Vulnerable | Micro Focus International |
- cpe:2.3:a:microfocus:groupwise:*:*:*:*:*:*:*:* Versions before 18.0.2 Vulnerable ·Micro Focus International
Remediation
- Fix · CNA GroupWise (Micro Focus) Fixed in 18.0.2
Timeline
- 2026-10-02 Threatist record created from CVE-2018-12468
- 2026-10-03 Alias added: GHSA-rcvg-q682-c3rx
References
More Micro Focus vulnerabilities
- TI-2021-05471 OS command injection in Operation Bridge Reporter. KEVCVSS 3.1CRITICAL 9.8
- TI-2021-05475 Advance configuration exposing Information Leakage vulnerability in Micro Focus Access… KEVCVSS 3.1HIGH 7.5
- TI-2018-08950 Unauthenticated SQL injection in Micro Focus Secure Messaging Gateway CVSS 3.0CRITICAL 10.0
- TI-2020-09524 Hard-coded credentials in Micro Focus Application Performance Management CVSS 3.1CRITICAL 9.8
- TI-2018-08951 Remote Code Execution in Micro Focus Secure Messaging Gateway CVSS 3.0CRITICAL 9.1
- TI-2020-09523 Arbitrary code execution vulnerability on multiple Micro Focus products CVSS 3.1HIGH 8.8
Sources
- CVE-2018-12468 · CVE Program
- CVE-2018-12468 · NVD
- FIRST EPSS
- GHSA-rcvg-q682-c3rx · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences