CVE-2026-2123

HIGH

Privilege escalation vulnerability in Operations Agent

Title source: cna
STIX 2.1

Description

A security audit identified a privilege escalation vulnerability in Operations Agent(<=OA 12.29) on Windows. Under specific conditions Operations Agent may run executables from specific writeable locations.Thanks to Manuel Rickli & Philippe Leiser of Oneconsult AG for reporting this vulnerability

References (1)

Core 1
Core References
Customer Entitlement customer-entitlement
https://portal.microfocus.com/s/article/KM000046068

Scores

CVSS v3 7.8
EPSS 0.0010
EPSS Percentile 1.1%
Attack Vector LOCAL
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact total

Details

CWE
CWE-280
Status published
Products (2)
microfocus/operations_agent 12.22 - 12.29
OpenText/Operations Agent OA 12.22 - OA 12.29
Published Mar 31, 2026
Tracked Since Mar 31, 2026