CVE-2022-26329: File existence disclosue vulnerability in IDM plugin

Severity: medium (CVSS 5.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2023-01-26 · updated 2026-06-17
Weakness: CWE-538

Description

File existence disclosure vulnerability in NetIQ Identity Manager plugin prior to version 4.8.5 allows attacker to determine whether a file exists on the filesystem. This issue affects: Micro Focus NetIQ Identity Manager NetIQ Identity Manager versions prior to 4.8.5 on ALL.

Affected products

NetIQ Identity Manager: before 4.8.5 — fixed in 4.8.5

How to fix

Upgrade to a fixed version: NetIQ Identity Manager 4.8.5. Check the vendor advisory for mitigations.

References

https://www.netiq.com/documentation/identity-manager-48/releasenotes_idm485/data/software-fixes.html
https://www.netiq.com/documentation/identity-manager-48/releasenotes_idm485/data/software-fixes.html

Get alerted when CVE-2022-26329 or the next vulnerability affects your stack