EUVD-2026-17534Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from Vendor (OpenText) · only source for this CVE.
CVSS VectorVendor: OpenText
Lifecycle Timeline
3DescriptionCVE.org
A security audit identified a privilege escalation vulnerability in Operations Agent(<=OA 12.29) on Windows. Under specific conditions Operations Agent may run executables from specific writeable locations.Thanks to Manuel Rickli & Philippe Leiser of Oneconsult AG for reporting this vulnerability
AnalysisAI
Privilege escalation in OpenText Operations Agent versions 12.29 and earlier on Windows allows local attackers to execute arbitrary code by placing malicious executables in specific writeable directories, which the agent subsequently executes with elevated privileges. The vulnerability requires local access and specific conditions to be present but does not require prior authentication to the agent itself. No public exploit code has been identified, and there is no confirmation of active exploitation at time of analysis.
Technical ContextAI
OpenText Operations Agent is a Windows-based monitoring and management component that executes system tasks and processes. The vulnerability stems from CWE-280 (Improper Handling of Insufficient Permissions or Privileges), indicating a failure in access control logic during executable loading or invocation. The agent appears to search for or load executables from directories with insufficient write-protection, allowing an unprivileged local user to introduce malicious binaries that the agent-running with elevated system privileges-subsequently executes. This is a classic DLL hijacking or binary search-path vulnerability pattern where the agent does not properly validate the source or integrity of executables before execution.
RemediationAI
Update OpenText Operations Agent to a version later than 12.29 as soon as feasible. Consult OpenText's KM000046068 article (https://portal.microfocus.com/s/article/KM000046068) for the exact patched version number and upgrade procedures. As an interim mitigation pending patching, restrict write permissions on directories from which Operations Agent loads or searches for executables, ensuring that only administrative accounts and the Operations Agent service account have write access. Additionally, enforce principle of least privilege for user accounts interacting with the system and monitor file creation events in sensitive system directories for unauthorized executable placement.
More in Operations Agent
View allUnspecified vulnerability in HP Operations Agent before 11.03.12 allows remote attackers to execute arbitrary code via u
Unspecified vulnerability in HP Operations Agent before 11.03.12 allows remote attackers to execute arbitrary code via u
Unspecified vulnerability in HP Operations Agent 11.00, when Glance is used, allows local users to gain privileges via u
Escalation of privileges vulnerability in Micro Focus Operations Agent, affects versions 12.0x, 12.10, 12.11, 12.12, 12.
Cross-site scripting (XSS) vulnerability in HP Operations Agent in HP Operations Manager (formerly OpenView Communicatio
During a renegotiation handshake if the Encrypt-Then-Mac extension is negotiated where it was not in the original handsh
Local privilege escalation vulnerability affects OpenText Operations Agent product versions 12.15 and 12.20-12.25 when i
Unauthorized escalation of local privileges vulnerability on Micro Focus Operation Agent, affecting all versions prior t
XXE attack vulnerability on Micro Focus Operations Agent, affected version 12.0, 12.01, 12.02, 12.03, 12.04, 12.05, 12.0
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in OpenText™ O
Same technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today