CVE-2018-6486: MFSBGN03797 rev.1 - Micro Focus Fortify Audit Workbench (AWB) and Micro Focus Fortify Software Security Center (SSC), XML External Entity Injection

Security readout for executives and security teams

CVE-2018-6486 is an XML External Entity injection issue in Micro Focus Fortify Audit Workbench and Software Security Center versions 16.10, 16.20, and 17.10. It matters because vulnerable XML handling can expose limited data, affect integrity, or disrupt availability. The source bundle does not show active exploitation or detailed remediation. Exposure is limited to organizations running Micro Focus Fortify Audit Workbench or Software Security Center versions 16.10, 16.20, or 17.10. Prioritize environments where SSC is reachable over a network or integrated into application security workflows that process XML content. Treat this as high priority if affected Fortify versions remain in use, especially for network-accessible SSC deployments. The issue affects security tooling, so compromise or disruption could undermine application security operations. Urgency is reduced only if inventory proves affected versions are absent or isolated. Mitigation focus: Inventory Fortify AWB and SSC deployments for versions 16.10, 16.20, and 17.10.; Review Micro Focus advisory KM03083653 for vendor-confirmed fixes or workarounds.; Apply only vendor-supported updates or mitigations for affected Fortify versions..

Prepared

May 24, 2026, 09:54 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.