External risk intelligence

OpenText EnCase SAFE Agents Unauthorized Connection Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-75120

The vulnerability affects endpoint agents (EnCase SAFE Agents) used for forensic and security investigations. These agents are typically deployed on internal network endpoints and managed by a central server. While the vulnerability allows for unauthorized connections, these agents are generally not designed for direct public internet exposure, making widespread internet reachability uncommon in standard deployments.

Halo Surface Signal: 2 out of 5 — less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A security vulnerability has been identified in OpenText's EnCase SAFE Agents, which are part of their endpoint investigation and security solutions. This issue could allow unauthorized access to these agents by bypassing security measures during the connection process. The main concern is to confirm if these agents are in use and exposed in a way that could be exploited.

Unauthorized connections bypassing security controls.
Confirm relevance and exposure for leadership.
Understand potential unauthorized access risks.

Attack Path

How an attacker could exploit the issue

An attacker could reach the vulnerable OpenText™ SAFE Agents, which are part of various OpenText™ investigation and security products. These agents are exposed to the network, potentially allowing an unauthenticated attacker to establish a connection by bypassing security controls. This could lead to unauthorized activity on the agent.

Agents are exposed to the network.
Bypassing security controls during session establishment.
Unauthorized and unauthenticated activity.

Live Threat

Current exploitation, exposure, and threat context

The OpenText (EnCase SAFE Agents) component could allow an unauthenticated attacker to establish unauthorized connections by bypassing security controls. This could affect system data and service behavior when the agents are accessible.

System data and service behavior at risk.
Unauthorized connection bypassing security controls.
Potentially impact investigation integrity.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability affects OpenText SAFE Agents, likely managed by security or endpoint operations teams responsible for investigations and security tooling. The immediate first step is to identify all deployed EnCase SAFE Agents, confirm their network exposure, and determine if they are business-critical before planning remediation.

Security or endpoint operations teams own this.
Verify agent reachability and criticality.
Plan phased remediation by risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the EnCase SAFE Agent component?

EnCase SAFE Agents are specialized software modules used within OpenText products—including Endpoint Investigator, Forensics & Response, and Information Assurance—to facilitate secure remote forensic data collection and endpoint security monitoring across enterprise systems.

What does CWE-290 mean for CVE-2026-75120?

This vulnerability involves Authentication Bypass by Spoofing. In the context of CVE-2026-75120, the agent fails to correctly verify the identity of a connecting party during session establishment, allowing an unauthorized entity to mimic a legitimate server and interact with the agent as if they were authorized.

How does an attacker trigger this vulnerability?

The flaw is triggered when an attacker initiates a network connection to a vulnerable agent. Because the vulnerability exists in the session establishment process, it does not require a pre-existing authenticated session or user interaction. If an attacker can reach the agent over the network, they can attempt to bypass the intended security controls.

Is my organization at risk from this CVE?

Halo Surface Signal indicates that these agents are typically deployed on internal network endpoints managed by a central server, making direct public internet exposure uncommon. Organizations should evaluate whether their specific agent architecture allows for network-level access from unauthorized segments, as these agents are generally not designed for public reachability.

How should I respond to this security notice?

Start by identifying all deployed EnCase SAFE Agents within your environment. Once mapped, confirm their network accessibility and current configuration. Prioritize assessing the criticality of the systems hosting these agents and consult the official OpenText support documentation to identify the appropriate path for applying security updates.

References

support.opentext.com/csm?id=ot_kb_unauthenticated&sysparm_article=KB0872887

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.