HP One Agent EUVD-2026-109122

Requires the attacker to already have a low-privileged local account on an HP PC that has HP One Agent software installed (AV:L, PR:L, no user interaction). The weakness is CWE-427 (Uncontrolled Search Path Element), so exploitation depends on the attacker being able to place a malicious file in a location the agent searches when loading components; the exact trigger and the specific writable path are not described in the available sources. Limiting factors: exploitation is not possible remotely or without a prior local foothold, and it only affects systems where HP One Agent is deployed - machines without this agent are unaffected.

This is a genuine but access-gated risk rather than an internet-facing emergency. The vendor-supplied CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:L/UI:N) and the CWE-427 (Uncontrolled Search Path Element) classification agree: exploitation is LOCAL, low-complexity, and requires the attacker to already hold low privileges on the machine (PR:L), with no user interaction. The high triad (VC:H/VI:H/VA:H, SC/SI/SA:N) reflects full compromise of the local system via privilege escalation, consistent with the stated 'escalation of privilege and/or arbitrary code execution.' The vuln.today decision label is 'this_week' - elevated but not act_now/emergency - which matches a local privilege-escalation flaw. No CISA KEV listing, no EPSS score, and no PoC/exploit reference were supplied, so exploitation status is 'no public exploit identified at time of analysis.' SIGNAL CONFLICT TO NOTE: the input Tags include 'RCE' (remote code execution), but the CVSS vector is AV:L and the description describes local privilege escalation; treat this as LOCAL arbitrary code execution, not network-reachable RCE. EPSS and KEV data are absent (not zero), so widespread-exploitation probability cannot be quantified from the provided data. Net: prioritize for HP-managed fleets within the vendor-suggested week, but it is not a remotely exploitable, mass-scannable issue.

An attacker who already has a low-privileged foothold on an HP PC running HP One Agent abuses the uncontrolled search path (CWE-427) to have the agent load an attacker-supplied binary/library, executing code at the agent's elevated privilege level. No public exploit code was identified in the provided data, and because the CVSS vector is AV:L, this requires prior local access rather than remote delivery.