Read the docs
TI-2026-85608 Aliases CVE-2026-1339

Open redirect in OpenText UCMDB and Operations Bridge Manager

Priority LOW 23CWE-601Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Active
Attack complexity
Low
Attack requirements
None
Impact type
Spoofing
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-601.

Summary

Classic deployments of the UCMDB UI (ucmdb-browser) component in OpenText Universal Discovery and CMDB and Operations Bridge Manager are affected from 2023.05, 23.4, 24.2, 24.4, 25.2 and 25.4 before 26.2. Containerized deployments are not affected. An open redirect (CWE-601) sends users to an untrusted site chosen by an attacker. A remote attacker needs no privileges, only a user who follows a crafted URL.

Written with Claude Haiku 5.5 from the sources below · 2026-11-05

Description from the CNA

An Open Redirect vulnerability has been identified in OpenText™ Universal Discovery and CMDB. The vulnerability can be exploited only if an attacker sends a specially crafted URL containing a link to a malicious resource and a user subsequently follows that link. Affected systems: This issue affects only the classic deployment options for UCMDB UI (ucmdb-browser) component within Universal Discovery and CMDB and Operations Bridge Manager. Containerized deployment options are not affected.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00211 11th percentileScored 2026-11-07
Fix Fixed Universal Discovery and CMDB (OpenText): 26.2Operations Bridge Manager (OpenText): 26.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
OpenTextUniversal Discovery and CMDB2023.05; 23.4; 24.2; 24.4; 25.2; 25.426.2Patch availableCNA
OpenTextOperations Bridge Manager2023.05; 23.4; 24.2; 24.4; 25.2; 25.426.2Patch availableCNA
  • Universal Discovery and CMDB VendorOpenText Affected 2023.05; 23.4; 24.2; 24.4; 25.2; 25.4 Fixed in 26.2 Patch available CNA
  • Operations Bridge Manager VendorOpenText Affected 2023.05; 23.4; 24.2; 24.4; 25.2; 25.4 Fixed in 26.2 Patch available CNA

Remediation

OpenText Universal Discovery and CMDB is fixed in 26.2, and Operations Bridge Manager is fixed in 26.2.

Written with Claude Haiku 5.5 from the sources below · 2026-11-05

  • Fix · CNA Universal Discovery and CMDB (OpenText) Fixed in 26.2
  • Fix · CNA Operations Bridge Manager (OpenText) Fixed in 26.2

Timeline

  1. 2026-11-05 Threatist record created from CVE-2026-1339
  2. 2026-11-05 CVSS score added · CISA ADP
  3. 2026-11-05 CISA SSVC decision points changed

References

Other 2

  • TI-2022-22711 An issue was discovered in OpenText Content Suite Platform 22.1 (16.2.19.1803). CVSS 3.1HIGH 8.8
  • TI-2022-22712 A remote OScript execution issue was discovered in OpenText Content Suite Platform 22.1… CVSS 3.1HIGH 8.8
  • TI-2022-22710 An issue was discovered in OpenText Content Suite Platform 22.1 (16.2.19.1803). CVSS 3.1HIGH 8.8
  • TI-2022-22707 An issue was discovered in OpenText Content Suite Platform 22.1 (16.2.19.1803). CVSS 3.1HIGH 8.8
  • TI-2022-22706 An issue was discovered in OpenText Content Suite Platform 22.1 (16.2.19.1803). CVSS 3.1HIGH 8.8
  • TI-2022-22709 An issue was discovered in OpenText Content Suite Platform 22.1 (16.2.19.1803). CVSS 3.1HIGH 7.5
See all 252 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences