CVE-2024-3969 is a high severity flaw in OpenText iManager 3.2.6.0200, scored 7.8 by NVD. The record describes an XML external entity injection that could lead to remote code execution when untrusted XML is parsed. The only linked source is the iManager 3.2.6 Patch 3 Hotfix 1 release note, so apply that hotfix or later and confirm the fix there.
What's affected
The record names OpenText iManager 3.2.6.0200, with CPE entries for the 3.2.6 base release and its patch levels. iManager is the web administration console for NetIQ eDirectory, which explains the Micro Focus vendor name in the CPE data.
The record does not state a fixed version in its own text. Its single reference is the release note for iManager 3.2.6 Patch 3 Hotfix 1, which points to that hotfix as the fix vehicle. This write-up did not fetch the page, so read it to confirm that this CVE is listed and which build closes it.
The vector is CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H. It needs local access, high complexity and a low privilege login, with a changed scope. The KEV flag is false and the record reports no exploitation.
The NVD record is dated 2024-05-28 and carries the vector CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H, a score of 7.8 (High). Weakness class: CWE-611.
How to check if you're exposed
Find the iManager version in the web console under the About or Help menu, or in the install directory on the host. Compare it with the build named in the Patch 3 Hotfix 1 release notes.
Check every eDirectory administration host, because iManager is often installed once and left alone, which is how old builds survive for years. Then check who can reach the console, since placing it on a restricted management network narrows who can try anything at all.
Free dependency scanning needs no account: paste a manifest into the in-browser scan to see which known CVEs apply to the libraries you ship. The Gold directory lists each CVE with its affected packages.
What to do now
- Inventory every iManager instance and record its build.
- Apply iManager 3.2.6 Patch 3 Hotfix 1 or later, after reading the release notes to confirm this CVE is covered.
- Restrict the iManager web console to an administrative network and to named administrators.
- Review administrator rights in eDirectory and remove accounts that do not need them.
- Back up the configuration before patching, following the vendor's guidance.
Why it matters
The weakness is XML external entity injection, CWE-611. An XML parser that allows external entities can be told by the document to fetch files or URLs and fold the result into its output. The record says untrusted XML parsing could lead to remote code execution.
The standard fix pattern is to disable external entity resolution and document type definitions in the parser. If you write code that parses XML, set those options explicitly instead of relying on defaults.
iManager administers a directory service, so a compromise tends to reach identities and access rules, not just one application. Four iManager CVEs were published in the same period, so treat the hotfix as covering a set and check each one in the release notes.
Quick check
Which release fixes CVE-2024-3969?
The record gives no version. Its reference is the Patch 3 Hotfix 1 release note, so confirm the fix status there.
Is it exploited in the wild?
The KEV flag is false and the record reports no exploitation.
Sources
Last reviewed: 19 October 2026.
