What’s Vulnerable › Vulnerabilities

CVE-2026-12559: Stored Cross-Site Scripting (XSS) in OpenText Vendor Invoice Management for SAP Solutions Capture Validation Application

• Severity: high (CVSS 7.3 v4.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-09-24 · updated 2026-09-24
• Weakness: CWE-79

Description

A Stored Cross-Site Scripting (XSS) vulnerability has been identified in OpenText Vendor Invoice Management for SAP Solutions Capture Validation application. Under certain conditions, this issue could allow execution of unauthorized script content in a user's browser, potentially impacting confidentiality and integrity of information processed through the application.

Affected products

• OpenText Vendor Invoice Management for SAP Solutions: from VIM 7.6/20.4 through 0009; from VIM 23.4 through 0004; from VIM 25.4 through 0001

References

• https://support.opentext.com/csm?id=kb_article_view&sysparm_article=KB0869040
• https://support.opentext.com/csm?id=ot_kb_unauthenticated&sysparm_article=KB0869044

Get alerted when CVE-2026-12559 or the next vulnerability affects your stack