A flaw in the OpenText EnCase SAFE Agents allows an unauthorized entity to establish a session with the agent by bypassing the intended authentication controls during session establishment. This results in remote code execution privileges, enabling the attacker to perform arbitrary actions such as data exfiltration, denial of service, or further network compromise. The weakness is a form of Improper Authentication, labeled as CWE-290 in the CVE record.

The vulnerability affects the OpenText EnCase SAFE Agents component used by OpenText Endpoint Investigator, Endpoint Forensics & Response, Information Assurance, and Endpoint Security. No specific agent versions are listed, so any deployment using this component may be impacted.

The CVSS score of 9.3 indicates a critical severity level. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalogue. The likely attack vector is a remote unauthenticated network connection that exploits the session‑establishment bypass. Because authentication is not required, any host with network reachability to the vulnerable agent could potentially exploit the flaw, making exploitation straightforward for an adversary in the same network or with privileged remote access.