Cross-Site Scripting Vulnerability in OpenText ZENworks Service Desk
CVE-2026-3278

7.4HIGH

Key Information:

Vendor

Opentext™

Status
Zenworks Service Desk
Vendor
CVE Published:
18 March 2026

What is CVE-2026-3278?

A Cross-Site Scripting (XSS) vulnerability exists in OpenText ZENworks Service Desk that results from improper neutralization of user input during web page generation. This flaw allows attackers to inject malicious JavaScript, potentially executing unauthorized actions on behalf of legitimate users. Affected installations include ZENworks Service Desk versions 25.2 and 25.3, underscoring the critical need for timely updates to safeguard against misuse.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

ZENworks Service Desk 25.2

ZENworks Service Desk 25.3

References

https://portal.microfocus.com/s/article/KM000045873?langu...

CVSS V4

Score:
7.4
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.