Operations Agent CVE-2026-2123

Requires local access to Windows system running Operations Agent version 12.29 or earlier. Attacker needs low-privilege user account. Victim interaction required: user must execute or interact with a crafted file placed in writable locations that Operations Agent monitors.

While a CVSS score is not provided, the vulnerability presents moderate-to-high real-world risk for Windows environments. The attack vector is local (requiring system access), which reduces exposure compared to network-based attacks, but privilege escalation from low to high privilege is a critical impact. The specificity requirement ('under specific conditions') suggests the vulnerability may not be trivial to exploit, which may reduce frequency in unmanaged environments; however, in managed or shared Windows systems where users have write access to common directories, exploitation becomes practical. The lack of a CVSS vector and published EPSS score prevents quantitative comparison, but the combination of confirmed privilege escalation capability, a known reporting source (Oneconsult AG security researchers), and the targeting of an enterprise management tool elevates priority for organizations using Operations Agent in sensitive environments. Without KEV confirmation or public exploit code, this appears to be a genuine but not yet weaponized vulnerability.

An unprivileged local user on a Windows system running vulnerable Operations Agent identifies a writeable directory in the agent's executable search path (such as a temp folder, a shared directory, or an unprotected plugin location). The attacker places a malicious executable with a name the agent expects (e.g., a legitimate DLL or executable name), and when the agent performs a scheduled task or maintenance operation, it loads and executes the attacker's payload with system-level privileges. This allows the attacker to escalate from user-level to system-level access without requiring credentials or exploitation of a remote service. No public exploit proof-of-concept has been identified, but the attack pattern is well-established in Windows privilege escalation research.