CVE-2026-2123: Privilege escalation vulnerability in Operations Agent

Severity: high (CVSS 7.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-03-31 · updated 2026-07-24
Weakness: CWE-280

Description

A security audit identified a privilege escalation vulnerability in Operations Agent(<=OA 12.29) on Windows. Under specific conditions Operations Agent may run executables from specific writeable locations.Thanks to Manuel Rickli & Philippe Leiser of Oneconsult AG for reporting this vulnerability

Affected products

Operations Agent: from 12.22 through 12.29

References

https://portal.microfocus.com/s/article/KM000046068

Get alerted when CVE-2026-2123 or the next vulnerability affects your stack