Authentication bypass in OpenText EnCase SAFE Agents enables unauthorized Agent connections

The OpenText™ (EnCase SAFE Agents) component utilized by OpenText™ Endpoint Investigator, OpenText™ Endpoint Forensics & Response, OpenText™ Information Assurance, and OpenText™ Endpoint Security contains a security vulnerability on the Agents that could allow unauthorized or unauthenticated activity that establishes an unauthorized connection to a vulnerable Agent by bypassing intended security controls during session establishment.

The following entries have default_status set to unaffected, while the explicit ranges in the CNA data are marked affected:

• Endpoint Investigator: module SAFE 25.4; the version entry beginning at 0 with lessThanOrEqual set to 26.1 is marked affected. The change at SAFE 25.4.3 is marked unaffected.
• Endpoint Forensics & Response: module SAFE 25.4; the version entry beginning at 0 with lessThanOrEqual set to 26.1 is marked affected. The change at SAFE 25.4.3 is marked unaffected.
• Information Assurance: module SAFE 25.4; the version entry beginning at 0 with lessThanOrEqual set to 26.1 is marked affected. The change at SAFE 25.4.3 is marked unaffected.
• Endpoint Security: module SAFE 24.1; the version entry beginning at 0 with lessThanOrEqual set to 24.1 is marked affected. The change at SAFE 25.1.2 is marked unaffected.

The record does not establish the status of every other release branch or show that every later version is safe. The lower-bound value 0 is part of the CNA’s custom version representation and should be reconciled with the deployed SAFE Agent inventory.

The vulnerability is in the EnCase SAFE Agents component used by OpenText Endpoint Investigator, Endpoint Forensics & Response, Information Assurance, and Endpoint Security. It is classified as CWE-290 authentication bypass by spoofing and occurs during session establishment. Attacker-controlled activity can cause a vulnerable Agent to accept an unauthorized or unauthenticated connection even though the intended security controls should reject it. The supplied CVSS data describes network reachability, no required privileges, no user interaction, and low attack complexity. The specific message, handshake field, protocol, or endpoint involved has not been disclosed, so payloads and exploit sequences should not be inferred.

The vulnerability is network reachable and, according to the supplied CVSS data, does not require prior authentication or privileges, does not require user interaction, and has low attack complexity. The essential condition is that a vulnerable Agent can receive session-establishment traffic from the attacker’s network position. The record marks public_exploit as false, while known_exploited and ransomware_campaign do not provide a confirmed status. These fields do not prove that exploitation has never occurred; the available record does not identify a specific campaign, victim, or exploit.

An unauthorized connection to an Agent can weaken the authentication boundary of the SAFE Agents component and permit activity against the endpoint managed by that Agent. The supplied impact data describes potentially high effects on confidentiality, integrity, and availability.

• Technically, an attacker may obtain capabilities available to a valid Agent connection.
• Organizationally, this could corrupt investigation data, interrupt collection, or reduce the ability to respond to endpoint incidents.
• The exact post-connection privileges and available operations are not disclosed, so a specific execution chain should not be assumed.

If an unauthorized connection is accepted, an attacker may influence the Agent and the operations available to it. Potential consequences include:

• Exposure of data or information collected from endpoints.
• Modification of Agent-related state, data, or administrative activity.
• Disruption of endpoint collection, investigation, response, or protection workflows.

The practical outcome depends on the Agent’s permissions and deployment configuration, which are not disclosed. The record does not identify a specific breach, victim, or campaign.

1. Upgrade OpenText EnCase SAFE Agents to the patched version. This is the solution stated in the record.
2. For Endpoint Investigator, Endpoint Forensics & Response, and Information Assurance, SAFE 25.4.3 is marked unaffected in the CNA data. For Endpoint Security, SAFE 25.1.2 is marked unaffected.
3. Confirm that the applicable marker matches the deployed SAFE module and product branch. Do not infer that a separate release branch is remediated merely because one branch is marked unaffected.
4. After updating, recheck the Agent inventory and confirm that session establishment works with authorized identities. If the installed build cannot be mapped to the markers above, obtain an OpenText-confirmed patched build for the deployed branch before treating the system as remediated.

1. Inventory all systems using OpenText Endpoint Investigator, Endpoint Forensics & Response, Information Assurance, or Endpoint Security, and identify the EnCase SAFE Agents installed on those systems.
2. Check the installed Agent and SAFE module versions, then compare them with the affected branches and unaffected markers in affected_summary.
3. Review Agent network telemetry and connection logs for unexpected session establishment, especially connections that are not associated with a valid identity or authorized management workflow. This is precautionary monitoring, not a vendor-confirmed indicator of compromise.
4. Investigate Agents that accept unauthorized or unauthenticated connections, correlating timestamps, source networks, and related administrative activity where those records are available.
5. Do not treat the absence of suspicious events in available logs as proof of safety, because the record does not publish complete log names, event identifiers, or detection indicators.