CVE-2024-3967 is a high severity unsafe Java object deserialization flaw in OpenText iManager 3.2.6.0200, scored 7.6 by NVD. The record says it can trigger remote code execution. The only linked source is the iManager 3.2.6 Patch 3 Hotfix 1 release note, so apply that hotfix or later and confirm the fix there.
What's affected
The record names OpenText iManager 3.2.6.0200, with CPE entries for the 3.2.6 base release and its patch levels. iManager is the web administration console for NetIQ eDirectory, which explains the Micro Focus vendor name in the CPE data.
The record does not state a fixed version in its own text. Its single reference is the release note for iManager 3.2.6 Patch 3 Hotfix 1, which points to that hotfix as the fix vehicle. This write-up did not fetch the page, so read it to confirm that this CVE is listed and which build closes it.
The vector is CVSS:3.1/AV:A/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H. It needs adjacent network access, high complexity, a low privilege login and user interaction, and the scope is changed. The KEV flag is false and the record reports no exploitation.
The NVD record is dated 2024-05-15 and carries the vector CVSS:3.1/AV:A/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H, a score of 7.6 (High). Weakness class: CWE-502.
How to check if you're exposed
Find the iManager version in the web console under the About or Help menu, or in the install directory on the host. Compare it with the build named in the Patch 3 Hotfix 1 release notes.
Check every eDirectory administration host. iManager is often installed once and left alone, which is how old builds survive for years.
Also check who can reach the console. The vector calls for adjacent network access and an authenticated user, so placing the console on a restricted management network cuts the exposure sharply.
Free dependency scanning needs no account: paste a manifest into the in-browser scan to see which known CVEs apply to the libraries you ship. The Gold directory lists each CVE with its affected packages.
What to do now
- Inventory every iManager instance and record its build.
- Apply iManager 3.2.6 Patch 3 Hotfix 1 or later, after reading the release notes to confirm this CVE is covered.
- Restrict the iManager web console to an administrative network and to named administrators.
- Review administrator rights in eDirectory and remove accounts that do not need them.
- Back up the configuration before patching, following the vendor's guidance.
Why it matters
The weakness is deserialization of untrusted data, CWE-502. Java can rebuild objects from a byte stream, and if the stream comes from an untrusted source, the objects it creates can trigger code paths the developer never intended. That is why the record can describe remote code execution from a deserialization bug.
iManager administers a directory service, so a compromise tends to reach identities and access rules, not just one application. Four iManager CVEs were published in the same period, so treat the hotfix as covering a set and check each one in the release notes.
If your own Java code deserializes data, the lasting defences are to avoid native Java serialization for untrusted input, and to use an allow list of permitted classes where you cannot.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Does an attacker need an account?
The vector shows low privileges required, so a login is needed, along with adjacent network access and user interaction.
Which release fixes it?
The record gives no version. Its reference is the Patch 3 Hotfix 1 release note, so confirm the fix status there.
Sources
Last reviewed: 19 October 2026.
