CVE-2025-15579
CriticalSummary
Deserialization of Untrusted Data vulnerability in OpenText Directory Services allows Object Injection. It could lead to remote code execution, denial of service, or privilege escalation. Affects versions before 24.4.16, 25.1 before 25.1.9, 25.2 before 25.2.9, 25.3 before 25.3.8, 25.4 before 25.4.5, and 26.1 before 26.1.2.
Risk Assessment
An attacker can take control of the system, cause service disruption, or gain elevated privileges. This is a serious threat to the entire infrastructure.
Recommendation
Update OpenText Directory Services to one of the patched versions immediately and restrict deserialization of untrusted data.
Original NVD description (English source)
Deserialization of Untrusted Data vulnerability in OpenText™ Directory Services allows Object Injection. The vulnerability could lead to remote code execution, denial of service, or privilege escalation. This issue affects Directory Services: before 24.4.16, from 25.1 before 25.1.9, from 25.2 before 25.2.9, from 25.3 before 25.3.8, from 25.4 before 25.4.5, from 26.1 before 26.1.2.