CVE-2025-15579
CriticalSummary
Deserialization of Untrusted Data vulnerability in OpenText Directory Services allows Object Injection. It could lead to remote code execution, denial of service, or privilege escalation. Affects versions before 24.4.16, 25.1 before 25.1.9, 25.2 before 25.2.9, 25.3 before 25.3.8, 25.4 before 25.4.5, and 26.1 before 26.1.2.
Risk Assessment
An attacker can take control of the system, cause service disruption, or gain elevated privileges. This is a serious threat to the entire infrastructure.
Recommendation
Update OpenText Directory Services to one of the patched versions immediately and restrict deserialization of untrusted data.
Other vulnerabilities in OpenText Directory Services
See all- CVE-2023-7249Critical
A path traversal vulnerability in OpenText Directory Services allows an attacker to access files outside the intended directory. It affects versions from 16.4.2 before 24.1.
- CVE-2026-13202High
OpenText Directory Services through version 22.2 contains an input data manipulation vulnerability.
Original NVD description (English source)
Deserialization of Untrusted Data vulnerability in OpenText™ Directory Services allows Object Injection. The vulnerability could lead to remote code execution, denial of service, or privilege escalation. This issue affects Directory Services: before 24.4.16, from 25.1 before 25.1.9, from 25.2 before 25.2.9, from 25.3 before 25.3.8, from 25.4 before 25.4.5, from 26.1 before 26.1.2.