The vulnerability arises from improper neutralization of user input during web page generation in OpenText ZENworks Service Desk. It allows attackers to inject and execute arbitrary JavaScript in the victim’s browser, enabling actions performed as the authenticated user. This is a classic Reflected or Stored XSS flaw (CWE‑79) with potential to compromise confidentiality, integrity, or availability of user sessions. The CVSS score of 7.4 indicates a high severity impact if successfully exploited.

Affected products are OpenText ZENworks Service Desk versions 25.2 and 25.3, as identified by the vendor and supported CPE entries cpe:2.3:a:opentext:zenworks_service_desk:25.2:* and cpe:2.3:a:opentext:zenworks_service_desk:25.3:*. These versions expose the input handling paths that allow the XSS payload to be rendered.

The vulnerability is remotely exploitable via the web interface; an attacker could supply crafted input through standard request parameters or form fields. The EPSS score of <1% suggests low current exploitation probability, and the vulnerability is not listed in the CISA KEV catalog. Nonetheless, given the high CVSS score, organizations running 25.2 or 25.3 should treat this as a significant risk and prioritize remediation.