Extended ECM for SAP: what OpenText's recent support alerts ask you to check
Several Extended ECM articles on OpenText My Support were refreshed around the start of October. Most aren't new, which is why they're easy to scroll past. Three belong in your next patch planning meeting, and they matter most if Extended ECM for SAP 21.4 is still in production, since OpenText's lifecycle page ends its Current Maintenance on 1 November 2026.
Each alert below has the same shape: what you do depends on the version you run. So the first step is the same for all of them. Know your Content Server (CE) version and patch level, and your Extended ECM for SAP release.
1. CVE-2025-8716 (KB0847046). OpenText rates it medium, CVSS v4 5.8. It affects Content Management (Extended ECM) CE 20.4 through 25.3. In the advisory's words, an authenticated user who knows exact filenames can download files that aren't protected. The fix path is version-specific. CE 25.4 and later are fixed. Hotfixes exist for CE 23.4 through 25.3. CE 20.4 through 23.3 should upgrade to at least 23.4. Read the article for the hotfix list and apply it, or plan the upgrade it names.
An older advisory sits next to it. KB0781429 covers Content Server vulnerabilities CVE-2022-45922 through CVE-2022-45928, including one rated critical. It affects CE 16.2.2 through 16.2.11 and 20.2 through 22.3, and 22.4 isn't affected. The patches are listed in the article. If any Extended ECM system in your estate is below 22.4, that patch list belongs in the same meeting.
2. Purge settings (KB0801652). We covered this in Thursday's engineering post. Inconsistent ancestor data can flag documents for deletion, and purging can then lose data. It's fixed in 22.4, but systems upgraded from CE 20.4 through 22.3 may still be affected, and the article tells customers to disable auto-purge, stop manual purging and review the Recycle Bin settings. The summary doesn't carve out any solution, so treat an Extended ECM for SAP system with that upgrade history as in scope until you've checked.
3. One download (KB0785672). From CE 23.1, Extended ECM solutions, Extended ECM for SAP included, ship in a single Extended ECM download. Existing installations keep using System Center Manager, and the change brings no license expansion. It's not a risk. It is a reason to reread your upgrade runbook: if it was written for 21.4, the download step in it is out of date.
One more, only if it applies to you. If you also run Extended ECM (Content Management) for SAP SuccessFactors, which is HR content and not your SAP ERP, KB0859978 says Basic Auth for outbound calls from SuccessFactors Document Management to OpenText left maintenance on 14 May 2026 and is fully decommissioned on 21 May 2027. Versions 22.3 and later can move to X.509, using the article it links (KB0859686). Versions 22.2 and earlier need an upgrade first.
Who keeps the register. In our view the Extended ECM platform owner holds one version and patch register for every system, production and non-production. Security reads each advisory against it. The records owner signs off any change to purge or Recycle Bin settings, because those settings decide what can be recovered. One page covers it:
CE version, patch level and Extended ECM for SAP release, per system.
For KB0847046 and KB0781429: not affected, hotfix applied, or upgrade planned, with a date.
Auto-purge status and Recycle Bin settings, checked against KB0801652.
Upgrade runbook updated for the single download.
That register also answers Tuesday's question about 1 November. Same facts, one owner.
