TI-2026-85626 Aliases CVE-2026-19134 GHSA-7rgv-j7cg-c4qw

Observable discrepancy in OpenText Directory Services (OTDS)

LOW 31CWE-203Published 2026-11-05 · Updated 2026-11-05

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Attack requirements: None
Impact type: Information disclosure
Confidentiality · integrity · availability: High · None · None
Fix status: Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-203.

Summary

OpenText Directory Services (OTDS) from 22.1 through 26.2 contains an observable discrepancy (CWE-203) that lets attackers learn internal details of the product by comparing its responses. A remote attacker with low privileges can exploit this without user interaction, which gives high confidentiality impact.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Description from the CNA

A vulnerability in OpenText OpenText Directory Services (OTDS) allows Black Box Reverse Engineering. This issue affects OpenText Directory Services (OTDS): from 22.1 to 26.2

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00299 22nd percentileScored 2026-11-07

Fix Fixed OpenText Directory Services (OTDS) (OpenText): 26.2.5, 26.1.8, 25.4.11 +11

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
OpenText	OpenText Directory Services (OTDS)	22.1 – 26.2	26.2.5, 26.1.8, 25.4.11, 25.3.13, 25.2.11, 25.1.12, 24.4.22, 24.3.7, 24.2.8, 23.4.20, 23.3.11, 23.2.8, 23.1.10, 22.4.21	Patch available	CNA

OpenText Directory Services (OTDS) VendorOpenText Affected 22.1 – 26.2 Fixed in 26.2.5, 26.1.8, 25.4.11, 25.3.13, 25.2.11, 25.1.12, 24.4.22, 24.3.7, 24.2.8, 23.4.20, 23.3.11, 23.2.8, 23.1.10, 22.4.21 Patch available CNA

Remediation

Upgrade OpenText Directory Services (OTDS) to a fixed version: 26.2.5, 26.1.8, 25.4.11, 25.3.13, 25.2.11, 25.1.12, 24.4.22, 24.3.7, 24.2.8, 23.4.20, 23.3.11, 23.2.8, 23.1.10 or 22.4.21, matching your installed release line.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Fix · CNA OpenText Directory Services (OTDS) (OpenText) Fixed in 26.2.5, 26.1.8, 25.4.11, 25.3.13, 25.2.11, 25.1.12, 24.4.22, 24.3.7, 24.2.8, 23.4.20, 23.3.11, 23.2.8, 23.1.10, 22.4.21

Timeline

2026-11-05 Threatist record created from CVE-2026-19134
2026-11-05 CVSS score added · CISA ADP
2026-11-05 CISA SSVC decision points changed
2026-11-05 Priority changed: MEDIUM → LOW
2026-11-05 Alias added: GHSA-7rgv-j7cg-c4qw

References

Other 1

https://support.opentext.com/csm?id=ot_kb_unauthenticated&sysparm_article=KB0876890

TI-2022-22711 An issue was discovered in OpenText Content Suite Platform 22.1 (16.2.19.1803). CVSS 3.1HIGH 8.8
TI-2022-22712 A remote OScript execution issue was discovered in OpenText Content Suite Platform 22.1… CVSS 3.1HIGH 8.8
TI-2022-22710 An issue was discovered in OpenText Content Suite Platform 22.1 (16.2.19.1803). CVSS 3.1HIGH 8.8
TI-2022-22707 An issue was discovered in OpenText Content Suite Platform 22.1 (16.2.19.1803). CVSS 3.1HIGH 8.8
TI-2022-22706 An issue was discovered in OpenText Content Suite Platform 22.1 (16.2.19.1803). CVSS 3.1HIGH 8.8
TI-2022-22709 An issue was discovered in OpenText Content Suite Platform 22.1 (16.2.19.1803). CVSS 3.1HIGH 7.5

See all 252 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences