Is CVE-2026-112256 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-112256 being exploited in the wild.

How severe is CVE-2026-112256?

Informational severity, published 29 October 2026.

Which products and versions are affected?

Opentext Advanced Authentication Server 6.4.0.0 through 6.4.3.8, 6.5.0.0 through 6.5.0.10, 6.6.0.0 through 6.6.1.0.

Is there a fix for CVE-2026-112256?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

Am I affected by CVE-2026-112256?

Check whether you run Opentext Advanced Authentication Server at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-112256: OpenText Advanced Authentication Server ACL bypass via extraneous data

CVE-2026-112256 · Severity: info · Published 2026-10-29

OpenText Advanced Authentication Server is an identity management system that controls access to corporate applications. A vulnerability allows attackers to bypass access controls by sending untrusted data alongside trusted authentication information, potentially gaining access to functions they should not be permitted to use.

Vendors: Opentext.

Quick answers

Is CVE-2026-112256 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-112256 being exploited in the wild.
How severe is CVE-2026-112256?: Informational severity, published 29 October 2026.
Which products and versions are affected?: Opentext Advanced Authentication Server 6.4.0.0 through 6.4.3.8, 6.5.0.0 through 6.5.0.10, 6.6.0.0 through 6.6.1.0.
Is there a fix for CVE-2026-112256?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-112256 attacked?: It is in a hosted service.
Am I affected by CVE-2026-112256?: Check whether you run Opentext Advanced Authentication Server at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

This is a CWE-290 (Acceptance of extraneous untrusted data with trusted data) vulnerability in Advanced Authentication Server. The flaw allows untrusted data to be processed alongside authenticated requests, bypassing ACL (access control list) restrictions. An authenticated attacker or one with network access can exploit this to access functionality that should be restricted to them.

Affected products

OpenText Advanced Authentication Server 6.4.0.0 through 6.4.3.8, 6.5.0.0 through 6.5.0.10, 6.6.0.0 through 6.6.1.0

Timeline

2026-10-29: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.