CVE-2020-11853: Arbitrary code execution vulnerability on multiple Micro Focus products

Severity: high (CVSS 8.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 77.0% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2020-10-22 · updated 2026-06-17

Description

Arbitrary code execution vulnerability affecting multiple Micro Focus products. 1.) Operation Bridge Manager affecting version: 2020.05, 2019.11, 2019.05, 2018.11, 2018.05, versions 10.6x and 10.1x and older versions. 2.) Application Performance Management affecting versions : 9.51, 9.50 and 9.40 with uCMDB 10.33 CUP 3 3.) Data Center Automation affected version 2019.11 4.) Operations Bridge (containerized) affecting versions: 2019.11, 2019.08, 2019.05, 2018.11, 2018.08, 2018.05, 2018.02, 2017.11 5.) Universal CMDB affecting version: 2020.05, 2019.11, 2019.05, 2019.02, 2018.11, 2018.08, 2018.05, 11, 10.33, 10.32, 10.31, 10.30 6.) Hybrid Cloud Management affecting version 2020.05 7.) Service Management Automation affecting version 2020.5 and 2020.02. The vulnerability could allow to execute arbitrary code.

Affected products

HP Universal Cmbd Foundation: 10.20, 10.30, 10.31, 10.32, 10.33, 11.0 (+7)
Micro Focus Application Performance Management: 9.40, 9.50, 9.51
Micro Focus Data Center Automation: through 2019.11
Micro Focus Hybrid Cloud Management: from 2018.05 through 2020.05
Micro Focus Operation Bridge Manager: through 10.10; 10.11, 10.12, 10.60, 10.61, 10.62, 10.63
Operations Bridge Manager.: 2017.11, 2018.02, 2018.05, 2018.08, 2018.11, 2019.05 (+3)
Micro Focus International Micro Focus - Service Manager Automation (SMA): 2020.02, 2020.05

References

Get alerted when CVE-2020-11853 or the next vulnerability affects your stack