CVE-2024-1470 is a high severity (CVSS 7.1) authorization bypass through a user-controlled key in OpenText NetIQ Client Login Extension on Windows, allowing privilege escalation and code injection. The record says only version 4.6 is affected. Check the vendor knowledge base article for the fixed release.
What's affected
The record says the issue affects only NetIQ Client Login Extension version 4.6 on Windows. The vendor's tracking article is the single reference in the record.
I could not retrieve that article when writing, so I cannot confirm a fixed version or a patch name. Treat the vendor article as the authority, and do not assume a later 4.x build is clean until it says so.
The record names the impact as privilege escalation and code injection. That is enough to treat affected Windows endpoints as in scope for patching.
How to check if you're exposed
On a Windows endpoint, open Apps and Features and look for NetIQ Client Login Extension, then read the version number. You can also query installed software from PowerShell:
Get-Package -Name "*NetIQ*"
If your endpoint management tool keeps software inventory, query it for the product name and filter for version 4.6. This turns a per-machine check into a one-time report.
To check a whole codebase at once, run the free in-browser dependency scan at gold.safeguard.sh/scan. You can also look up the CVE in the Gold directory, and use reachability analysis to see whether your code calls the affected path.
What to do now
- Inventory endpoints with NetIQ Client Login Extension installed.
- Open the vendor knowledge base article and note the fixed version or patch.
- Apply the update or patch to every affected endpoint.
- Restrict local logon rights on shared or kiosk machines until patched.
- Watch endpoint detection alerts for unexpected privileged processes on those machines.
Why it matters
The record classes this as CWE-639, authorization bypass through a user-controlled key. The component accepted a value from the caller to decide what it could access, so a low privilege user could steer the decision.
Software that runs at login sits near the authentication path, which is why a flaw there matters for privilege. The vector requires an attacker to already have a presence on the machine, which keeps the score at 7.1. The record's KEV flag is false.
Quick check
Which versions are affected?
Only 4.6, per the record.
Is it remotely exploitable?
The record does not describe a remote path. Read the vendor article for the attack requirements.
Sources
- Vendor knowledge base article KM000026667 (not retrievable when written)
- NVD record data for CVE-2024-1470
Last reviewed: 19 October 2026.
