HP One Agent EUVD-2026-37011

Attacker must already have an interactive or remote shell as a low-privileged local user on an HP PC running an unpatched HP One Agent build (CVSS PR:L, AV:L), and must be able to write to a directory consulted by the agent's search path or influence a configuration/PATH element it trusts. No user interaction is required (UI:N) and attack complexity is low (AC:L), but exploitation is limited to hosts where HP One Agent is actually installed - typically HP commercial/enterprise PCs - and to OS sessions where the attacker has at least standard-user logon rights; remote network exploitation is not in scope.

The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H) and score of 8.5 indicate a high-impact local attack that any logged-in standard user can perform reliably without user interaction - consistent with a classic DLL-hijack-style elevation against a SYSTEM service. There is no CISA KEV listing, no public PoC referenced, and no EPSS data supplied, so widespread opportunistic exploitation is unlikely; however, the very low bar (any local account) and the broad install base on HP enterprise endpoints make this a meaningful post-compromise privilege escalation path for malware or insiders. Note that the input provides only a 4.0 vector - a 3.1 equivalent must be derived rather than read directly, and the exact affected versions and patched build are not enumerated in the supplied references, only pointed to via HP's advisory page.

A standard domain user on an HP business laptop drops a malicious DLL into a directory that the HP One Agent service searches at load or update time; when the service next starts or reloads its modules, the planted DLL is loaded in the SYSTEM context, giving the attacker full local administrative control. The same primitive can be used to crash the agent on demand for denial of service, disabling HP-managed security and update telemetry on the host.