OpenText EnCase SAFE Agents: Authentication bypass during session establishment
Summary
The EnCase SAFE Agents component, shipped with OpenText Endpoint Investigator, Endpoint Forensics & Response, Information Assurance and Endpoint Security, contains a flaw in session establishment. An unauthenticated remote attacker who can reach an agent over the network can bypass the intended security controls and set up an unauthorized connection to it. The CVE description and CWE-290 point to an authentication bypass, while the CVE title says RCE; no source confirms code execution, so the impact must be verified against the vendor advisory. The CNA rates the issue CVSS 4.0 9.3 (Critical).
Affected
- OpenText Endpoint Investigator 0 to 26.1
- OpenText Endpoint Forensics & Response 0 to 26.1
- OpenText Information Assurance 0 to 26.1
- OpenText Endpoint Security 0 to 24.1
- Platforms: unverified. A third-party mirror names Windows, Mac, Linux, AIX and Solaris, but this is not confirmed by the vendor.
Fixed in
Unknown. Fixed versions are not named in the sources reviewed. Check KB0872887 for the patched builds.
Workaround
No vendor workaround identified. Confirm in KB0872887.
- Interim measure (not vendor-sourced): restrict network access to agent listening ports to management and check-in servers only.
Exploitation
- No evidence of exploitation in the wild found.
- No public proof-of-concept found.
- CISA SSVC assessment: Exploitation none, Automatable yes, Technical Impact total.
- Not listed in CISA KEV as far as the sources show; recheck the catalog.
Our recommendation
- Read KB0872887 and identify the fixed version for each installed product.
- Inventory all endpoints running the four affected products and their agent versions.
- Limit network access to agent ports to management and check-in servers only.
- Apply the vendor fix and redeploy the agents, then verify the upgrade. Do not rely on automatic upgrades.
- Recheck NVD and CISA KEV in the coming days, as the record is new.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- OpenText Knowledge Article KB0872887 support.opentext.com
- Vulners: NVD record CVE-2026-75120 vulners.com
- Vulners: Positive Technologies PT-2026-111867 vulners.com
- Vulners: EUVD-2026-99206 vulners.com
- CyStack: OpenText vulnerability database cystack.net
- Strix: CVE-2026-75120 www.strix.ai
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 02:16.
Original description (NVD)
The OpenText™ (EnCase SAFE Agents) component utilized by OpenText™ Endpoint Investigator, OpenText™ Endpoint Forensics & Response, OpenText™ Information Assurance, and OpenText™ Endpoint Security contains a security vulnerability on the Agents that could allow unauthorized or unauthenticated activity that establishes an unauthorized connection to a vulnerable Agent by bypassing intended security controls during session establishment
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.