High severity · published Sep 24, 2026
CVE-2026-12559
Stored Cross-Site Scripting (XSS) in OpenText Vendor Invoice Management for SAP Solutions Capture Validation Application
7.3
CVSS
0.4%
EPSS
No
On KEV
Description
A Stored Cross-Site Scripting (XSS) vulnerability has been identified in OpenText Vendor Invoice Management for SAP Solutions Capture Validation application. Under certain conditions, this issue could allow execution of unauthorized script content in a user's browser, potentially impacting confidentiality and integrity of information processed through the application.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 33% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
VI
Vendor Invoice Management for SAP Solutions · OpenText
VIM 7.6/20.4 through 0009; VIM 23.4 through 0004; VIM 25.4 through 0001 · source: vendor
Affected product
VI
Vendor Invoice Management for SAP Solutions
OpenText
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-12559
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-12559
support.opentext.com
https://support.opentext.com/csm?id=kb_article_view&sysparm_article=KB0869040
support.opentext.com
https://support.opentext.com/csm?id=ot_kb_unauthenticated&sysparm_article=KB0869044