CVE-2025-15579: An Insecure Deserialization vulnerability has been discovered in OpenText™ Directory Services.

Published Feb 18, 2026

Updated

Deserialization of Untrusted Data vulnerability in OpenText™ Directory Services allows Object Injection.

The vulnerability could lead to remote code execution, denial of service, or privilege escalation.

This issue affects Directory Services: before 24.4.16, from 25.1 before 25.1.9, from 25.2 before 25.2.9, from 25.3 before 25.3.8, from 25.4 before 25.4.5, from 26.1 before 26.1.2.

Affected Software

1 affected component

OpenText Directory Services<24.4.16, >undefined, >undefined, >undefined, >undefined, >undefined

Remediation

Information

https://support.opentext.com/csm?id=ot_kb_unauthenticated&sysparm_article=KB0859600&sys_kb_id=f82c01214707b6144549b6bd416d43b7&spa=1

Event History

Feb 18, 2026

CVE Published

via MITRE·02:57 PM

Data Sourced

via MITRE·02:57 PM

RemedyDescriptionWeakness

Data Sourced

via NVD·04:22 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What is the severity of CVE-2025-15579?

The severity of CVE-2025-15579 is critical due to the potential for remote code execution, denial of service, or privilege escalation.

How do I fix CVE-2025-15579?

To fix CVE-2025-15579, update OpenText Directory Services to the latest version beyond 26.1.

Which versions of OpenText Directory Services are affected by CVE-2025-15579?

CVE-2025-15579 affects OpenText Directory Services versions from 10.5 to 26.1.

What type of attacks can CVE-2025-15579 enable?

CVE-2025-15579 can enable attacks such as remote code execution, denial of service, and privilege escalation.

Is CVE-2025-15579 a local or remote vulnerability?

CVE-2025-15579 is a remote vulnerability, allowing attackers to exploit it over the network.