CVE-2018-19644: Solutions Business Manager (SBM) reflected cross site script issue in version prior to 11.5

Security readout for executives and security teams

CVE-2018-19644 is a reflected cross-site scripting issue in Micro Focus Solutions Business Manager before version 11.5. A successful attack would require user interaction and could let attacker-controlled script run in a user's browser context, creating confidentiality risk for sensitive SBM data. Exposure is limited to organizations running Micro Focus SBM versions earlier than 11.5. Risk depends on whether affected SBM interfaces are reachable by users and whether attackers can induce interaction by a valid low-privileged user. Treat this as a moderate-priority remediation item for any legacy SBM deployment. It is not supported by active-exploitation evidence in the provided sources, but confidentiality impact can matter if SBM contains sensitive workflow, business, or security-process data. Mitigation focus: Upgrade Micro Focus SBM to version 11.5 or later.; Review Micro Focus or Serena release notes for vendor-confirmed remediation details.; Restrict access to SBM interfaces to trusted users and networks..

Prepared

Jun 1, 2026, 04:38 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.