Read the docs
TI-2023-15563 Aliases CVE-2023-32265GHSA-36c2-gx9g-q34j

Mitigations and availability of updates relating to security vulnerability in ESCWA component CVE-2023-32265.

Priority LOW 32Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · Low · None
Fix status
No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

A potential security vulnerability has been identified in the Enterprise Server Common Web Administration (ESCWA) component used in Enterprise Server, Enterprise Test Server, Enterprise Developer, Visual COBOL, and COBOL Server. An attacker would need to be authenticated into ESCWA to attempt to exploit this vulnerability. As described in the hardening guide in the product documentation, other mitigations including restricting network access to ESCWA and restricting users’ permissions in the Micro Focus Directory Server also reduce the exposure to this issue. Given the right conditions this vulnerability could be exploited to expose a service account password. The account corresponding to the exposed credentials usually has limited privileges and, in many cases would only be useful for extracting details of other user accounts and similar information.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00454 39th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Micro FocusEnterprise Server6.0 – 6.0 update 24; 7.0 – 7.0 update 17; 8.0 – 8.0 update 6—No fix listedCNA
Micro FocusEnterprise Test Server6.0 – 6.0 update 24; 7.0 – 7.0 update 17; 8.0 – 8.0 update 6—No fix listedCNA
Micro FocusEnterprise Developer6.0 – 6.0 update 24; 7.0 – 7.0 update 17; 8.0 – 8.0 update 6—No fix listedCNA
Micro FocusVisual COBOL6.0 – 6.0 update 24; 7.0 – 7.0 update 17; 8.0 – 8.0 update 6—No fix listedCNA
Micro FocusCOBOL Server6.0 – 6.0 update 24; 7.0 – 7.0 update 17; 8.0 – 8.0 update 6—No fix listedCNA
  • Enterprise Server VendorMicro Focus Affected 6.0 – 6.0 update 24; 7.0 – 7.0 update 17; 8.0 – 8.0 update 6 Fixed in — No fix listed CNA
  • Enterprise Test Server VendorMicro Focus Affected 6.0 – 6.0 update 24; 7.0 – 7.0 update 17; 8.0 – 8.0 update 6 Fixed in — No fix listed CNA
  • Enterprise Developer VendorMicro Focus Affected 6.0 – 6.0 update 24; 7.0 – 7.0 update 17; 8.0 – 8.0 update 6 Fixed in — No fix listed CNA
  • Visual COBOL VendorMicro Focus Affected 6.0 – 6.0 update 24; 7.0 – 7.0 update 17; 8.0 – 8.0 update 6 Fixed in — No fix listed CNA
  • COBOL Server VendorMicro Focus Affected 6.0 – 6.0 update 24; 7.0 – 7.0 update 17; 8.0 – 8.0 update 6 Fixed in — No fix listed CNA

CPE configurations NVD · 15

CPEVersionsRoleVendor
cpe:2.3:a:microfocus:cobol_server:6.0:-:*:*:*:*:*:*6.0VulnerableMicro Focus International
cpe:2.3:a:microfocus:cobol_server:7.0:-:*:*:*:*:*:*7.0VulnerableMicro Focus International
cpe:2.3:a:microfocus:cobol_server:8.0:-:*:*:*:*:*:*8.0VulnerableMicro Focus International
cpe:2.3:a:microfocus:enterprise_developer:6.0:-:*:*:*:*:*:*6.0VulnerableMicro Focus International
cpe:2.3:a:microfocus:enterprise_developer:7.0:-:*:*:*:*:*:*7.0VulnerableMicro Focus International
cpe:2.3:a:microfocus:enterprise_developer:8.0:-:*:*:*:*:*:*8.0VulnerableMicro Focus International
cpe:2.3:a:microfocus:enterprise_server:6.0:-:*:*:*:*:*:*6.0VulnerableMicro Focus International
cpe:2.3:a:microfocus:enterprise_server:7.0:-:*:*:*:*:*:*7.0VulnerableMicro Focus International
cpe:2.3:a:microfocus:enterprise_server:8.0:-:*:*:*:*:*:*8.0VulnerableMicro Focus International
cpe:2.3:a:microfocus:enterprise_test_server:6.0:-:*:*:*:*:*:*6.0VulnerableMicro Focus International
Show 5 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:microfocus:enterprise_test_server:7.0:-:*:*:*:*:*:*7.0VulnerableMicro Focus International
cpe:2.3:a:microfocus:enterprise_test_server:8.0:-:*:*:*:*:*:*8.0VulnerableMicro Focus International
cpe:2.3:a:microfocus:visual_cobol:6.0:-:*:*:*:*:*:*6.0VulnerableMicro Focus International
cpe:2.3:a:microfocus:visual_cobol:7.0:-:*:*:*:*:*:*7.0VulnerableMicro Focus International
cpe:2.3:a:microfocus:visual_cobol:8.0:-:*:*:*:*:*:*8.0VulnerableMicro Focus International

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-32265
  2. 2026-10-03 Alias added: GHSA-36c2-gx9g-q34j

References

Advisory 1

  • TI-2021-05471 OS command injection in Operation Bridge Reporter. KEVCVSS 3.1CRITICAL 9.8
  • TI-2021-05475 Advance configuration exposing Information Leakage vulnerability in Micro Focus Access… KEVCVSS 3.1HIGH 7.5
  • TI-2018-08950 Unauthenticated SQL injection in Micro Focus Secure Messaging Gateway CVSS 3.0CRITICAL 10.0
  • TI-2020-09524 Hard-coded credentials in Micro Focus Application Performance Management CVSS 3.1CRITICAL 9.8
  • TI-2018-08951 Remote Code Execution in Micro Focus Secure Messaging Gateway CVSS 3.0CRITICAL 9.1
  • TI-2020-09523 Arbitrary code execution vulnerability on multiple Micro Focus products CVSS 3.1HIGH 8.8
See all 128 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences