How severe is CVE-2026-11877?

CVE-2026-11877 has a CVSS 3.x base score of 7.5, rated high severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is none, integrity high, and availability none.

Is CVE-2026-11877 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (7th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2026-11877?

CVE-2026-11877 primarily affects Microfocus Access Manager. In total, 3 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.

How do I fix CVE-2026-11877?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.

Does CVE-2026-11877 have an EU (EUVD) identifier?

Yes. CVE-2026-11877 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2026-38792.

When was CVE-2026-11877 published?

CVE-2026-11877 was published on 2026-06-24 and last updated on 2026-06-29.

CVE-2026-11877

CVE-2026-11877 is a high-severity vulnerability in Microfocus Access Manager with a CVSS 3.x base score of 7.5. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-648.

Key facts

Severity: High (CVSS 3.x base score 7.5)
CVSS v4: 6.3
EPSS exploit prediction: 0% (7th percentile)
Actively exploited: Not listed in CISA KEV
EU (EUVD) id: EUVD-2026-38792
Weakness: CWE-648
Affected product: Microfocus Access Manager
Published: 2026-06-24
Last modified: 2026-06-29

Description

An unauthorized user can modify configuration through API calls that affects the OpenText Access Manager. This issue affects Access Manager before 5.1.3.

Frequently asked questions

What is CVE-2026-11877?: An unauthorized user can modify configuration through API calls that affects the OpenText Access Manager. This issue affects Access Manager before 5.1.3.
How severe is CVE-2026-11877?: CVE-2026-11877 has a CVSS 3.x base score of 7.5, rated high severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is none, integrity high, and availability none.
Is CVE-2026-11877 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (7th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2026-11877?: CVE-2026-11877 primarily affects Microfocus Access Manager. In total, 3 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
How do I fix CVE-2026-11877?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.
Does CVE-2026-11877 have an EU (EUVD) identifier?: Yes. CVE-2026-11877 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2026-38792.
When was CVE-2026-11877 published?: CVE-2026-11877 was published on 2026-06-24 and last updated on 2026-06-29.

References

https://portal.microfocus.com/s/article/KM000047450

Affected products (3)

cpe:2.3:a:microfocus:access_manager:*:*:*:*:*:*:*:*
cpe:2.3:a:microfocus:access_manager:5.1:-:*:*:*:*:*:*
cpe:2.3:a:microfocus:access_manager:5.1:patch_update_2:*:*:*:*:*:*

More vulnerabilities in Microfocus Access Manager

CVE-2021-22528 — High (CVSS 8.0): Reflected Cross Site Scripting (XSS) vulnerability in NetIQ Access Manager prior to 5.0.1 and 4.5.4
CVE-2021-22506 — High (CVSS 7.5): Advance configuration exposing Information Leakage vulnerability in Micro Focus Access Manager product, affects all…
CVE-2021-22496 — High (CVSS 7.5): Authentication Bypass Vulnerability in Micro Focus Access Manager Product, affects all version prior to version…
CVE-2014-5217 — Medium (CVSS 6.8): Cross-site request forgery (CSRF) vulnerability in nps/servlet/webacc in the Administration Console server in NetIQ…
CVE-2026-11878 — Medium (CVSS 6.1): Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in OpenText Access…
CVE-2021-22531 — Medium (CVSS 6.1): A bug exist in the input parameter of Access Manager that allows supply of invalid character to trigger cross-site…

All CVEs affecting Microfocus Access Manager →

Other CWE-648 vulnerabilities

CVE-2026-41329 — Critical (CVSS 9.9): OpenClaw before 2026.3.31 contains a sandbox bypass vulnerability allowing attackers to escalate privileges via…
CVE-2024-8785 — Critical (CVSS 9.8): In WhatsUp Gold versions released before 2024.0.1, a remote unauthenticated attacker could leverage NmAPI.exe to…
CVE-2024-11068 — Critical (CVSS 9.8): The D-Link DSL6740C modem has an Incorrect Use of Privileged APIs vulnerability, allowing unauthenticated remote…
CVE-2023-4972 — Critical (CVSS 9.8): Incorrect Use of Privileged APIs vulnerability in Yepas Digital Yepas allows Collect Data as Provided by Users. This…
CVE-2026-41225 — Critical (CVSS 9.1): A vulnerability exists in iControl REST where a highly privileged, authenticated attacker with at least the Manager…
CVE-2026-41386 — Critical (CVSS 9.1): OpenClaw before 2026.3.22 contains a privilege escalation vulnerability where bootstrap setup codes are not bound to…

Browse all CWE-648 vulnerabilities →