Paper/Archive/CVE-2025-15579

CVE-2025-15579

OpenText™ Directory Services — An Insecure Deserialization vulnerability has been discovered in OpenText™ Directory Services.

EPSS 0.4%CVSS 9.5

critical.is priorityof 100

CVSS 9.5 (CNA)9.5 / 10 × 3028.5 Not in CISA KEV+300.0 EPSS percentile 37.4.374 × 207.5 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

Deserialization of Untrusted Data vulnerability in OpenText™ Directory Services allows Object Injection. The vulnerability could lead to remote code execution, denial of service, or privilege escalation. This issue affects Directory Services: before 24.4.16, from 25.1 before 25.1.9, from 25.2 before 25.2.9, from 25.3 before 25.3.8, from 25.4 before 25.4.5, from 26.1 before 26.1.2.

Affected

ProductAffectedFixed inSource

Directory Services< 24.4.1624.4.16CNA

Directory Services25.1 – < 25.1.925.1.9CNA

Directory Services25.2 – < 25.2.925.2.9CNA

Directory Services25.3 – < 25.3.825.3.8CNA

Directory Services25.4 – < 25.4.525.4.5CNA

Directory Services26.1 – < 26.1.226.1.2CNA

Scores by source

OpenText (CNA)9.5CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/S:P/AU:Y/R:U/V:C/RE:M/U:Red

CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

refsupport.opentext.com/csm?id=ot_kb_unauthenticated&sysparm_article=KB0859600&sys_kb_id=f82c01214707b6144549b6bd416d43b7&spa=1