CVE-2024-3486 is a high severity flaw (CVSS 7.8) in OpenText iManager 3.2.6.0200: an XML external entity injection flaw that the description says could lead to information disclosure and remote code execution. The NetIQ release notes list it as resolved in iManager 3.2.6.0301, which is 3.2 Service Pack 6 Patch 3 Hotfix 1. Upgrade to that release or later.
What's affected
The record lists OpenText (formerly Micro Focus) iManager 3.2.6.0200, with patch levels 3.2.6 patch 1 and patch 2 also appearing in the product list. The weakness is CWE-611 (XML external entity injection). The CVSS vector in the record says the attack is reached with local access, with high attack complexity, needing low privileges and no user interaction.
The NetIQ iManager 3.2 SP6 Patch 3 HotFix 1 release notes, dated April 2024, say the release resolves CVE-2024-3486 along with CVE-2024-3483 through CVE-2024-3488 and CVE-2024-3969. The fixed build is iManager 3.2.6.0301. The notes thank the reporter for disclosing file upload, request forgery, remote code execution, XXE, SSRF and path traversal issues. Related records in the same release: CVE-2024-3483, CVE-2024-3484, CVE-2024-3485, CVE-2024-3487, CVE-2024-3488. The record's KEV flag is false, so CISA's Known Exploited Vulnerabilities catalog did not list it when this record was captured.
The record's CVSS score is the NVD value. If your scanner shows a different score, trust the vendor notes for the fix and use the score only for ordering the work.
How to check if you're exposed
Find each iManager server, including those installed alongside eDirectory or Identity Manager. Check the installed build in the iManager about information or the installed package list, and compare it with 3.2.6.0301.
Note the vendor's install warnings before upgrading. The release notes say 3.2.6.0301 is not supported with eDirectory 9.2.8 or later if both are installed on the same machine, and that upgrading on Identity Manager Engine 4.8.6 may hit a class loading error with a documented fix. You can also run a free in-browser dependency scan at gold.safeguard.sh/scan to see which known vulnerabilities touch the open source packages you ship.
Safeguard's reachability analysis helps with the next question, which is whether the vulnerable code is actually called in your application, so you can order the work sensibly.
What to do now
- Inventory every iManager install and its build.
- Upgrade to iManager 3.2.6.0301 or later, after reading the release notes' install and compatibility warnings.
- Limit network access to iManager to a management network and named admin hosts.
- Review iManager and web server logs for unexpected requests or file uploads.
- Also confirm the other CVEs listed in the same release notes are covered by the upgrade.
Why it matters
iManager is an administration console for directory services, so it holds a great deal of trust in one place. Flaws in a console like this deserve attention even when scores are moderate, because the console can reach identity data and the machines it manages.
The weakness here is CWE-611 (XML external entity injection). Fixing it means upgrading to the patch. Meanwhile, keep admin consoles on a management network, require strong authentication and limit who can reach them. The record's KEV flag is false, so CISA's Known Exploited Vulnerabilities catalog did not list it when this record was captured.
Quick check
One upgrade for all six iManager CVEs?
Per the release notes, iManager 3.2.6.0301 resolves CVE-2024-3483 through CVE-2024-3488 together, along with CVE-2024-3969. Read the notes for install caveats first.
Sources
Last reviewed: 19 October 2026.
