Critical CVSS 9.4 Flaw in OpenText OBM Exposes Enterprises to Privilege Escalation Risk

OpenText has issued a critical security advisory addressing two significant vulnerabilities in its Operations Bridge Manager (OBM) software—CVE-2025-3476 and CVE-2025-3272—both affecting multiple versions of the platform. These flaws could be exploited by authenticated users to gain elevated privileges or bypass password authentication protocols.

Operations Bridge Manager (OBM) is a central component of OpenText’s AI Operations Management (AIOps) platform, providing enterprise-grade event and performance management. The platform offers unified visibility across complex IT environments, including on-premises systems, private/public clouds, and containerized infrastructure.

A high-severity vulnerability, tracked as CVE-2025-3476 (CVSSv4 9.4), has been identified that allows authenticated users to escalate their privileges within OBM environments. According to the advisory, “a vulnerability was detected in Operations Bridge Manager, which allows privilege escalation by authenticated users.”