CVE-2026-75120: OpenText EnCase SAFE Agents Auth Bypass

CVE-2026-75120 Overview

CVE-2026-75120 is an authentication bypass vulnerability in the OpenText EnCase SAFE Agents component. The flaw allows unauthenticated attackers to establish unauthorized connections to a vulnerable Agent by bypassing intended security controls during session establishment. The weakness is classified as Authentication Bypass by Spoofing [CWE-290]. The vulnerability affects multiple OpenText products that embed the EnCase SAFE Agent, including endpoint investigation and forensics tooling. Successful exploitation yields high impact to confidentiality, integrity, and availability on the targeted Agent host.

Critical Impact

Remote, unauthenticated attackers can bypass session-establishment controls to connect to EnCase SAFE Agents and gain forensic-grade access to endpoint data.

Affected Products

• OpenText Endpoint Investigator (EnCase SAFE Agents component)
• OpenText Endpoint Forensics & Response (EnCase SAFE Agents component)
• OpenText Information Assurance and OpenText Endpoint Security (EnCase SAFE Agents component)

Discovery Timeline

• 2026-10-13 - CVE CVE-2026-75120 published to NVD
• 2026-10-13 - Last updated in NVD database

Technical Details for CVE-2026-75120

Vulnerability Analysis

The EnCase SAFE (Secure Authentication for EnCase) Agent runs on monitored endpoints and accepts remote connections from the SAFE server for forensic acquisition, triage, and response actions. The session-establishment handshake is intended to authenticate the connecting party before any privileged operations are permitted. CVE-2026-75120 breaks that guarantee by allowing an attacker to spoof or bypass authentication during the handshake. Once connected, the attacker inherits the Agent's capabilities, which typically include file system access, memory inspection, and remote command functionality on the host. The vulnerability is reachable over the network with no user interaction and no prior credentials.

Root Cause

The root cause is improper authentication handling [CWE-290] in the SAFE Agent's session-establishment logic. The Agent fails to adequately verify the identity of the connecting SAFE server, allowing an attacker to assert a trusted identity without presenting valid proof. OpenText has not published implementation-level details in the public advisory.

Attack Vector

An attacker who can reach the Agent's listening port on the network initiates a connection and completes the handshake while bypassing the authentication step. No credentials, user interaction, or prior foothold is required. Because the Agent is deployed on investigation targets across the enterprise, a single exposed instance can be used to pivot into sensitive hosts. Refer to the OpenText Knowledge Base Article for vendor technical details.

// No verified proof-of-concept code is publicly available.
// See the OpenText Knowledge Base Article for vendor-supplied technical details.

Detection Methods for CVE-2026-75120

Indicators of Compromise

• Unexpected inbound TCP connections to EnCase SAFE Agent listening ports from hosts other than the authorized SAFE server
• Agent-initiated file reads, process enumeration, or acquisition jobs that do not correlate with a scheduled or analyst-driven investigation
• New or unknown source IP addresses appearing in SAFE Agent connection logs

Detection Strategies

• Baseline the authorized SAFE server IP addresses and alert on any Agent connection originating from an unlisted source
• Correlate Agent activity logs with SAFE server job records; flag Agent operations that lack a matching server-side job
• Deploy network IDS signatures to identify malformed or anomalous SAFE handshake traffic to Agent ports

Monitoring Recommendations

• Forward SAFE Agent and SAFE server logs to a centralized SIEM for correlation and long-term retention
• Monitor process creation and file access events on Agent-hosting endpoints for forensic tooling behavior outside planned engagements
• Alert on configuration changes to SAFE Agent trust stores or allow-lists

How to Mitigate CVE-2026-75120

Immediate Actions Required

• Apply the vendor-supplied update referenced in the OpenText Knowledge Base Article to all affected OpenText deployments
• Inventory all hosts running EnCase SAFE Agents and confirm patch status
• Restrict network reachability of Agent listening ports to the authorized SAFE server only

Patch Information

OpenText has published remediation guidance in Knowledge Base article KB0872887. Administrators should consult the OpenText Knowledge Base Article for fixed versions and upgrade instructions for each affected product line.

Workarounds

• Enforce host-based firewall rules that permit inbound Agent connections only from the authorized SAFE server IP addresses
• Place SAFE Agents and the SAFE server on a segmented management network isolated from general user and server VLANs
• Disable or uninstall the Agent on systems where remote forensic capability is not actively required

# Example: restrict inbound access to the SAFE Agent port to the authorized SAFE server
# Replace <AGENT_PORT> and <SAFE_SERVER_IP> with environment-specific values

# Windows (PowerShell)
New-NetFirewallRule -DisplayName "EnCase SAFE Agent - Allow SAFE Server" `
  -Direction Inbound -Protocol TCP -LocalPort <AGENT_PORT> `
  -RemoteAddress <SAFE_SERVER_IP> -Action Allow

New-NetFirewallRule -DisplayName "EnCase SAFE Agent - Block Others" `
  -Direction Inbound -Protocol TCP -LocalPort <AGENT_PORT> -Action Block

# Linux (iptables)
iptables -A INPUT -p tcp --dport <AGENT_PORT> -s <SAFE_SERVER_IP> -j ACCEPT
iptables -A INPUT -p tcp --dport <AGENT_PORT> -j DROP