CVE-2020-11854: Micro Focus Operations Bridge and APM hard-coded credentials allow remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

critical priorityCVSS 9.8 with network-only, unauthenticated remote code execution and very high EPSS make this an urgent patch target despite no KEV listing.

What it is

Micro Focus Operations Bridge Manager, Operations Bridge (containerized) and Application Performance Management contain a hard-coded credentials flaw (CWE-798) that permits arbitrary code execution. The network-reachable, unauthenticated nature of the issue makes it a serious risk for exposed management and monitoring infrastructure.

Impact

An unauthenticated remote attacker can execute arbitrary code on the affected server, gaining full control of the host and any data or credentials it holds.

Attack surface

Reachable over the network with no authentication and no user interaction required, per the CVSS vector AV:N/AC:L/PR:N/UI:N. Any internet- or network-exposed Operations Bridge or APM instance is in scope.

Exploitation

Not listed in CISA KEV and no ransomware association is documented, but EPSS is very high at roughly 0.74 (99.5th percentile), and public exploit material exists via Packet Storm and a ZDI advisory.

What to do

• Apply the vendor fixes referenced in the Micro Focus support documents KM03747657, KM03747658 and KM03747854 for all listed Operations Bridge Manager, Operations Bridge (containerized) and APM versions.
• Remove or restrict network exposure of Operations Bridge and APM management interfaces; place them behind VPN or an access-controlled jump host.
• Rotate any credentials, keys or certificates stored on or used by affected hosts, since hard-coded credentials may be reused elsewhere.
• Monitor vendor advisories for updated builds if the listed versions cannot be patched immediately.

Detection

• Hunt for unexpected outbound connections or process execution originating from Operations Bridge or APM server processes.
• Review web and application logs on affected hosts for anomalous requests to management endpoints from unfamiliar source IPs.
• Alert on new or unusual child processes spawned by the Java or application server hosting these products.
• Correlate authentication and configuration-change events on these systems with known maintenance windows.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.