CVE-2026-2123

HIGH

Privilege escalation vulnerability in Operations Agent

Title source: cna
STIX 2.1

Description

A security audit identified a privilege escalation vulnerability in Operations Agent(<=OA 12.29) on Windows. Under specific conditions Operations Agent may run executables from specific writeable locations.Thanks to Manuel Rickli & Philippe Leiser of Oneconsult AG for reporting this vulnerability

References (1)

Scores

CVSS v3 7.8
EPSS 0.0001
EPSS Percentile 2.4%
Attack Vector LOCAL
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact total

Details

CWE
CWE-280
Status published
Products (2)
microfocus/operations_agent 12.22 - 12.29
OpenText/Operations Agent OA 12.22 - OA 12.29
Published Mar 31, 2026
Tracked Since Mar 31, 2026