8.6High
CVE-2026-2123Privilege escalation vulnerability in Operations Agent
Description
A security audit identified a privilege escalation vulnerability in Operations Agent(<=OA 12.29) on Windows. Under specific conditions Operations Agent may run executables from specific writeable locations.Thanks to Manuel Rickli & Philippe Leiser of Oneconsult AG for reporting this vulnerability
Weakness (CWE):
CWE-280
Data: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Published as the sources state it, in English.
Affected products and versions
| Vendor | Product | Versions | |
|---|---|---|---|
| microfocus | operations agent | 12.22 – ≤ 12.29 | |
| OpenText | Operations Agent | OA 12.22 – ≤ OA 12.29 |
References and patches
- https://portal.microfocus.com/s/article/KM000046068 customer-entitlementVendor Advisory
CPE matches (NVD) (1)
cpe:2.3:a:microfocus:operations_agent:*:*:*:*:*:*:*:*≥ 12.22 ≤ 12.29