Unauthenticated remote code execution in Micro Focus Operations Bridge containerized…
Priority MEDIUM 46Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA.
Summary
Unauthenticated remote code execution in Micro Focus Operations Bridge containerized, affecting versions 2021.05, 2021.08, and newer versions of Micro Focus Operations Bridge containerized if the deployment was upgraded from 2021.05 or 2021.08. The vulnerability could be exploited to unauthenticated remote code execution.
Why it matters now
EPSS 0.02002 80th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | Operations Bridge containerized. | 2021.05, 2021.08, and newer versions of Micro Focus Operations Bridge containerized if the deployment was upgraded from 2021.05 or 2021.08 | — | No fix listed | CNA |
- Operations Bridge containerized. Vendor— Affected 2021.05, 2021.08, and newer versions of Micro Focus Operations Bridge containerized if the deployment was upgraded from 2021.05 or 2021.08 Fixed in — No fix listed CNA
CPE configurations NVD · 2
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:microfocus:operations_bridge:*:*:*:*:*:*:*:* | 2021.08 | Vulnerable | Micro Focus International |
| cpe:2.3:a:microfocus:operations_bridge:2021.05:*:*:*:*:*:*:* | 2021.05 | Vulnerable | Micro Focus International |
- cpe:2.3:a:microfocus:operations_bridge:*:*:*:*:*:*:*:* Versions 2021.08 Vulnerable ·Micro Focus International
- cpe:2.3:a:microfocus:operations_bridge:2021.05:*:*:*:*:*:*:* Versions 2021.05 Vulnerable ·Micro Focus International
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2021-38125
- 2026-10-03 Alias added: GHSA-5r8m-442m-m7hq
References
More Micro Focus International Operations Bridge vulnerabilities
- TI-2020-09524 Hard-coded credentials in Micro Focus Application Performance Management CVSS 3.1CRITICAL 9.8
- TI-2018-04780 Micro Focus Container Deployment Foundation (CDF), Remote Code Execution CVSS 3.0CRITICAL 9.8
- TI-2018-04781 Code injection in Micro Focus Network Operations Management Suite CDF CVSS 3.0CRITICAL 9.8
- TI-2018-13149 MFSBGN03829 rev.1 - Micro Focus Operation Bridge Containerized Suite, Remote Code Execution CVSS 3.0CRITICAL 9.6
- TI-2020-09528 Code execution with escalated privilegesn vlnerability in Operation bridge Manager and… CVSS 3.1HIGH 7.8
- TI-2022-18264 CVE-2022-38754 - Micro Focus Operations Bridge Manager and OpsBridge Containerized - Cross Site Scripting (XSS) CVSS 3.1HIGH 8.0
Sources
- CVE-2021-38125 · CVE Program
- CVE-2021-38125 · NVD
- FIRST EPSS
- GHSA-5r8m-442m-m7hq · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences