CVE-2024-3968 is a high severity flaw in OpenText iManager 3.2.6.0200, scored 7.8 by NVD. The record describes remote code execution through a custom file upload task. The only linked source is the iManager 3.2.6 Patch 3 Hotfix 1 release note, so apply that hotfix or later and confirm the fix there.
What's affected
The record names OpenText iManager 3.2.6.0200, with CPE entries for the 3.2.6 base release and its patch levels. iManager is the web administration console for NetIQ eDirectory, which explains the Micro Focus vendor name in the CPE data.
The record does not state a fixed version in its own text. Its single reference is the release note for iManager 3.2.6 Patch 3 Hotfix 1, which points to that hotfix as the fix vehicle. This write-up did not fetch the page, so read it to confirm that this CVE is listed and which build closes it.
The vector is CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H. It needs local access, high complexity and a low privilege login, with a changed scope. The KEV flag is false and the record reports no exploitation.
The NVD record is dated 2024-05-15 and carries the vector CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H, a score of 7.8 (High). Weakness class: CWE-20.
How to check if you're exposed
Find the iManager version in the web console under the About or Help menu, or in the install directory on the host. Compare it with the build named in the Patch 3 Hotfix 1 release notes.
Check every eDirectory administration host, because iManager is often installed once and left alone, which is how old builds survive for years. Then check who can reach the console, since placing it on a restricted management network narrows who can try anything at all.
Free dependency scanning needs no account: paste a manifest into the in-browser scan to see which known CVEs apply to the libraries you ship. The Gold directory lists each CVE with its affected packages.
What to do now
- Inventory every iManager instance and record its build.
- Apply iManager 3.2.6 Patch 3 Hotfix 1 or later, after reading the release notes to confirm this CVE is covered.
- Restrict the iManager web console to an administrative network and to named administrators.
- Review administrator rights in eDirectory and remove accounts that do not need them.
- Back up the configuration before patching, following the vendor's guidance.
Why it matters
The weakness is improper input validation, CWE-20. The record says the code execution comes through a custom file upload task, so content that the console accepts is not checked closely enough before it is acted on. The record gives no more detail and this write-up adds none.
The general lesson for upload features is to restrict file types, store uploads outside any path that the server executes, and avoid processing the content with powerful interpreters.
iManager administers a directory service, so a compromise tends to reach identities and access rules, not just one application. Four iManager CVEs were published in the same period, so treat the hotfix as covering a set and check each one in the release notes.
Quick check
Which release fixes CVE-2024-3968?
The record gives no version. Its reference is the Patch 3 Hotfix 1 release note, so confirm the fix status there.
Is it exploited in the wild?
The KEV flag is false and the record reports no exploitation.
Sources
Last reviewed: 19 October 2026.
