Skip to content
Fencer Vulns
high 7.1

CVE-2018-6499 json

Remote Code Execution in the following products Hybrid Cloud Management Containerized Suite HCM2017.11, HCM2018.02, HCM2018.05, Operations…

published 2018-08-30 8 y ago modified 2026-06-17 4 mo ago also EUVD-2018-18255

cvss
7.1
version 3.0, CNA
cisa kev
Not listed
not in CISA's catalog
epss
2.4%
EPSS 2.4% chance of exploitation in 30 days, percentile 84%
public exploits
0
none known

Summary

Remote Code Execution in the following products Hybrid Cloud Management Containerized Suite HCM2017.11, HCM2018.02, HCM2018.05, Operations Bridge Containerized Suite 2017.11, 2018.02, 2018.05, Data Center Automation Containerized Suite 2017.01 until 2018.05, Service Management Automation Suite 2017.11, 2018.02, 2018.05, Service Virtualization (SV) with floating licenses using Any version using APLS older than 10.7, Unified Functional Testing (UFT) with floating licenses using Any version using APLS older than 10.7, Network Virtualization (NV) with floating licenses using Any version using APLS older than 10.7 and Network Operations Management (NOM) Suite CDF 2017.11, 2018.02, 2018.05 will allow Remote Code Execution.

Exploit prediction

2.40% chance of exploitation in the next 30 days, higher than 84% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.0 7.1 CVSS:3.0/AV:A/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:H
NVD 3.0 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD 2.0 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P

Affected products

  • Micro Focus Network Operations Management (NOM) Suite CDF
  • Micro Focus Service Management Automation Suite
  • Micro Focus Data Center Automation Containerized Suite
  • Micro Focus Operations Bridge Containerized Suite
  • Micro Focus Hybrid Cloud Management Containerized Suite
  • Micro Focus Network Virtualization (NV) with floating licenses
  • Micro Focus Unified Functional Testing (UFT) with floating licenses
  • Micro Focus Service Virtualization (SV) with floating licenses

Classification

Weakness
  • CWE-94 Improper Control of Generation of Code

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.