VulnerabilityModified

CVE-2020-11853

Arbitrary code execution vulnerability affecting multiple Micro Focus products.

HIGH 8.8EPSS 77.0%

Does this matter?

EPSS puts the probability of exploitation in the next 30 days at 77.0%, higher than 100% of all known CVEs. Patch or mitigate before the next change window.

Description

Arbitrary code execution vulnerability affecting multiple Micro Focus products. 1.) Operation Bridge Manager affecting version: 2020.05, 2019.11, 2019.05, 2018.11, 2018.05, versions 10.6x and 10.1x and older versions. 2.) Application Performance Management affecting versions : 9.51, 9.50 and 9.40 with uCMDB 10.33 CUP 3 3.) Data Center Automation affected version 2019.11 4.) Operations Bridge (containerized) affecting versions: 2019.11, 2019.08, 2019.05, 2018.11, 2018.08, 2018.05, 2018.02, 2017.11 5.) Universal CMDB affecting version: 2020.05, 2019.11, 2019.05, 2019.02, 2018.11, 2018.08, 2018.05, 11, 10.33, 10.32, 10.31, 10.30 6.) Hybrid Cloud Management affecting version 2020.05 7.) Service Management Automation affecting version 2020.5 and 2020.02. The vulnerability could allow to execute arbitrary code.

CVSS 3.1: 8.8 HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS: 76.99% probability · 100th percentile
Public exploits: None in Exploit-DB
CISA KEV: Not listed
Affected: microfocus/operation bridge manager · microfocus/operations bridge manager · hp/universal cmbd foundation · microfocus/application performance management · microfocus/data center automation · microfocus/hybrid cloud management · microfocus/service manager automation
Source: security@opentext.com

EPSS trend

EPSS 77.0% since 3 November 2026; no change recorded yet. The dashed line is the ten per cent mark our analysts treat as “patch before the next change window”. Points are recorded when the score first appears and whenever it moves by a percentage point or more.

References

Source: NVD record, EPSS from FIRST.org, KEV from CISA, exploits from Exploit-DB. Refreshed daily. Download this record as JSON.