CVE-2026-11878

10th percentile — higher than 10% of all known CVEs

OpenText Access Manager versions 5.1 through 5.1.2 are vulnerable to Cross-Site Scripting (XSS) due to improper input neutralization during web page generation. This allows an attacker to inject malicious JavaScript into a victim's browser.

The risk includes session hijacking, data theft, or unauthorized actions performed in the context of the victim's session. This could compromise data confidentiality and integrity within the organization.

Immediately upgrade OpenText Access Manager to a version later than 5.1.2 that contains the fix. Until then, implement HTTP traffic filtering and apply Content Security Policy (CSP) rules.