PT-2026-20435 · Opentext · Opentext Directory Services

Published 2026-02-18 · Updated 2026-02-27 · CVE-2025-15579

Positive Technologies (AI Summary)

CVSS v4.0

9.5

Critical

Base vector

AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/S:P/AU:Y/R:U/V:C/RE:M/U:Red

Name of the Vulnerable Software and Affected Versions OpenText Directory Services versions 10.5 through 26.1

Description The software contains a flaw related to the deserialization of untrusted data, which allows for object injection. Successful exploitation of this issue could result in remote code execution, denial of service, or privilege escalation.

Recommendations Update OpenText Directory Services to a version later than 26.1.

Fix

LPE

RCE

DoS

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

CVE-2025-15579

Affected Products

Opentext Directory Services

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2025-15579 · Security Note
• https://support.opentext.com/csm?id=ot_kb_unauthenticated&sysparm_article=KB0859600&sys_kb_id=f82c01214707b6144549b6bd416d43b7&spa=1 · Note
• https://twitter.com/VulmonFeeds/status/2024220486842884161 · Twitter Post
• https://t.me/CVEtracker/44973 · Telegram Post
• https://t.me/cveNotify/153588 · Telegram Post
• https://twitter.com/0dayPublishing/status/2024145526699032846 · Twitter Post
• https://twitter.com/CVEnew/status/2024154250624778313 · Twitter Post