PT-2026-26064 · Opentext · Opentext Zenworks Service Desk

Published 2026-03-18 · Updated 2026-03-18 · CVE-2026-3278

Positive Technologies (AI Summary)

CVSS v4.0

7.4

High

Base vector

AV:N/AC:L/AT:P/PR:L/UI:P/VC:H/VI:H/VA:N/SC:L/SI:L/SA:N/S:N/AU:Y/R:U/V:D/RE:M/U:Amber

Name of the Vulnerable Software and Affected Versions OpenText ZENworks Service Desk versions 25.2 through 25.3

Description An improper neutralization of input during web page generation can lead to Cross-Site Scripting (XSS) in OpenText ZENworks Service Desk. This could allow an attacker to execute arbitrary JavaScript, potentially enabling unauthorized actions performed with a user's privileges.

Recommendations Update OpenText ZENworks Service Desk to a version later than 25.3.

Fix

RCE

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-3278

Affected Products

Opentext Zenworks Service Desk

References · 4

• https://portal.microfocus.com/s/article/KM000045873?language=en_US · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-3278 · Security Note
• https://twitter.com/fernandokarl/status/2034362683944808696 · Twitter Post
• https://twitter.com/CVEnew/status/2034365288150696035 · Twitter Post