CVE-2023-4501
A critical flaw in OpenText (Micro Focus) Visual COBOL and related products allows anyone with access to the system to log in as any user, even with the wrong password. The vulnerability is triggered when LDAP authentication is used in certain configurations. It can be fixed by applying the vendor’s upcoming patch update.
An official fix is available, so this entry is kept for 30 days and then removed automatically.
Who is affected
OpenText (Micro Focus) Visual COBOL, COBOL Server, Enterprise Developer, and Enterprise Server (including variants such as Enterprise Test Server) versions 7.0 (patch updates 19 and 20), 8.0 (patch updates 8 and 9), and 9.0 (patch update 1).
Real-world impact
An attacker who can reach the product can impersonate any user, gaining full access to the system’s data and functions.
Why this severity
The CVSS score of 9.8 reflects that the flaw allows remote attackers to bypass authentication with no user interaction, giving complete compromise of confidentiality, integrity, and availability.
What to do about it
- 01Download and install the vendor’s upcoming patch update for the affected product.
- 02Restart the product or service.
NVD-referenced vendor advisory
Timeline
- Sep 12, 2023 · Sep 12, 2023PublishedDisclosed and added to the National Vulnerability Database.
- Aug 4, 2026 · 2d agoAdvisory updatedThe NVD record was last revised.
- Aug 6, 2026 · 7h agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.
How it’s attacked
References & advisories
- portal.microfocus.com/s/article/KM000021287vendor advisory