A security audit identified a privilege escalation\nvulnerability in Operations Agent(<=OA 12.29) on Windows. Under specific conditions\nOperations Agent may run executables from specific writeable locations.Thanks to Manuel Rickli & Philippe Leiser of\nOneconsult AG for reporting this vulnerability
The hotfix can be downloaded from the Marketplace for the OA versions mentioned below.
Please follow the readme.txt\nincluded in the hotfix zip file for install instructions.
OA 12.24 - HFWIN_1224028.tar,\nHFWIN_1224029.tar
OA 12.25 -\nHFWIN_1225045.tar,HFWIN_1225046.tar
OA 12.26 - HFWIN_1226039.tar,\nHFWIN_1226040.tar
OA 12.27 - HFWIN_1227023.tar,\nHFWIN_1227024.tar
OA 12.28 - HFWIN_1228020.tar,\nHFWIN_1228021.tar
OA 12.29 - HFWIN_1229006.tar,\nHFWIN_1229007.tar
\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
"}]}], "source": {"defect": ["2761008"], "advisory": "2761008", "discovery": "EXTERNAL"}, "x_generator": {"engine": "Vulnogram 1.0.1"}, "x_gcve": [{"vulnId": "CVE-2026-2123", "recordType": "advisory"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-31T17:58:14.103027Z", "id": "CVE-2026-2123", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-31T18:00:56.901Z"}}]}, "vulnerability-lookup:meta": {"epss": {"cve": "CVE-2026-2123", "date": "2026-11-01", "epss": "0.00102", "percentile": "0.00929"}, "nvd": "{\"cve\":{\"id\":\"CVE-2026-2123\",\"sourceIdentifier\":\"security@opentext.com\",\"published\":\"2026-03-31T18:16:46.293\",\"lastModified\":\"2026-07-24T20:10:00.147\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"A security audit identified a privilege escalation\\nvulnerability in Operations Agent(<=OA 12.29) on Windows. Under specific conditions\\nOperations Agent may run executables from specific writeable locations.Thanks to Manuel Rickli & Philippe Leiser of\\nOneconsult AG for reporting this vulnerability\"},{\"lang\":\"es\",\"value\":\"Una auditor\u00eda de seguridad identific\u00f3 una vulnerabilidad de escalada de privilegios en Operations Agent (<=OA 12.29) en Windows. Bajo condiciones espec\u00edficas, Operations Agent puede ejecutar ejecutables desde ubicaciones espec\u00edficas con permisos de escritura. Gracias a Manuel Rickli y Philippe Leiser de Oneconsult AG por informar sobre esta vulnerabilidad.\"}],\"affected\":[{\"source\":\"security@opentext.com\",\"affectedData\":[{\"vendor\":\"OpenText\",\"product\":\"Operations Agent\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://gitlab.otxlab.net/itom/opr/oa/OvEaAgt\",\"packageName\":\"OvEaAgt\",\"modules\":[\"libopc_r\"],\"platforms\":[\"Windows\"],\"programFiles\":[\"ntproc.c\"],\"repo\":\"https://gitlab.otxlab.net/itom/opr/oa/OvEaAgt\",\"versions\":[{\"version\":\"OA 12.22\",\"lessThanOrEqual\":\"OA 12.29\",\"versionType\":\"custom\",\"status\":\"affected\",\"changes\":[{\"at\":\"OA 12.30\",\"status\":\"unaffected\"}]}]}]}],\"metrics\":{\"cvssMetricV40\":[{\"source\":\"security@opentext.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"4.0\",\"vectorString\":\"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X\",\"baseScore\":8.6,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"attackRequirements\":\"NONE\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"PASSIVE\",\"vulnConfidentialityImpact\":\"HIGH\",\"vulnIntegrityImpact\":\"HIGH\",\"vulnAvailabilityImpact\":\"HIGH\",\"subConfidentialityImpact\":\"HIGH\",\"subIntegrityImpact\":\"HIGH\",\"subAvailabilityImpact\":\"HIGH\",\"exploitMaturity\":\"NOT_DEFINED\",\"confidentialityRequirement\":\"NOT_DEFINED\",\"integrityRequirement\":\"NOT_DEFINED\",\"availabilityRequirement\":\"NOT_DEFINED\",\"modifiedAttackVector\":\"NOT_DEFINED\",\"modifiedAttackComplexity\":\"NOT_DEFINED\",\"modifiedAttackRequirements\":\"NOT_DEFINED\",\"modifiedPrivilegesRequired\":\"NOT_DEFINED\",\"modifiedUserInteraction\":\"NOT_DEFINED\",\"modifiedVulnConfidentialityImpact\":\"NOT_DEFINED\",\"modifiedVulnIntegrityImpact\":\"NOT_DEFINED\",\"modifiedVulnAvailabilityImpact\":\"NOT_DEFINED\",\"modifiedSubConfidentialityImpact\":\"NOT_DEFINED\",\"modifiedSubIntegrityImpact\":\"NOT_DEFINED\",\"modifiedSubAvailabilityImpact\":\"NOT_DEFINED\",\"Safety\":\"NOT_DEFINED\",\"Automatable\":\"NOT_DEFINED\",\"Recovery\":\"NOT_DEFINED\",\"valueDensity\":\"NOT_DEFINED\",\"vulnerabilityResponseEffort\":\"NOT_DEFINED\",\"providerUrgency\":\"NOT_DEFINED\"}}],\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-03-31T17:58:14.103027Z\",\"id\":\"CVE-2026-2123\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"total\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"security@opentext.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-280\"}]}],\"configurations\":[{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:microfocus:operations_agent:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"12.22\",\"versionEndIncluding\":\"12.29\",\"matchCriteriaId\":\"F6956571-9969-4994-8581-EF3E6EB77048\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"A2572D17-1DE6-457B-99CC-64AFD54487EA\"}]}]}],\"references\":[{\"url\":\"https://portal.microfocus.com/s/article/KM000046068\",\"source\":\"security@opentext.com\",\"tags\":[\"Vendor Advisory\"]}]}}", "redhat_vex": {"current_release_date": "2026-04-01T23:00:23+00:00", "cve": "CVE-2026-2123", "id": "CVE-2026-2123", "initial_release_date": "2026-01-01T00:00:00+00:00", "product_status:known_not_affected": "1", "source": "Red Hat CSAF VEX", "status": "final", "title": "Privilege escalation vulnerability in Operations Agent", "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-2123.json", "version": "3"}, "vulnrichment": {"containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-2123\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-03-31T17:58:14.103027Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-03-31T18:00:14.961Z\"}}], \"cna\": {\"tags\": [\"x_oa_privilege_escalation\"], \"title\": \"Privilege escalation vulnerability in Operations Agent\", \"source\": {\"defect\": [\"2761008\"], \"advisory\": \"2761008\", \"discovery\": \"EXTERNAL\"}, \"impacts\": [{\"capecId\": \"CAPEC-122\", \"descriptions\": [{\"lang\": \"en\", \"value\": \"CAPEC-122 Privilege Abuse\"}]}], \"metrics\": [{\"format\": \"CVSS\", \"cvssV4_0\": {\"Safety\": \"NOT_DEFINED\", \"version\": \"4.0\", \"Recovery\": \"NOT_DEFINED\", \"baseScore\": 8.6, \"Automatable\": \"NOT_DEFINED\", \"attackVector\": \"LOCAL\", \"baseSeverity\": \"HIGH\", \"valueDensity\": \"NOT_DEFINED\", \"vectorString\": \"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H\", \"exploitMaturity\": \"NOT_DEFINED\", \"providerUrgency\": \"NOT_DEFINED\", \"userInteraction\": \"PASSIVE\", \"attackComplexity\": \"LOW\", \"attackRequirements\": \"NONE\", \"privilegesRequired\": \"LOW\", \"subIntegrityImpact\": \"HIGH\", \"vulnIntegrityImpact\": \"HIGH\", \"subAvailabilityImpact\": \"HIGH\", \"vulnAvailabilityImpact\": \"HIGH\", \"subConfidentialityImpact\": \"HIGH\", \"vulnConfidentialityImpact\": \"HIGH\", \"vulnerabilityResponseEffort\": \"NOT_DEFINED\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"affected\": [{\"repo\": \"https://gitlab.otxlab.net/itom/opr/oa/OvEaAgt\", \"vendor\": \"OpenText\", \"modules\": [\"libopc_r\"], \"product\": \"Operations Agent\", \"versions\": [{\"status\": \"affected\", \"changes\": [{\"at\": \"OA 12.30\", \"status\": \"unaffected\"}], \"version\": \"OA 12.22\", \"versionType\": \"custom\", \"lessThanOrEqual\": \"OA 12.29\"}], \"platforms\": [\"Windows\"], \"packageName\": \"OvEaAgt\", \"programFiles\": [\"ntproc.c\"], \"collectionURL\": \"https://gitlab.otxlab.net/itom/opr/oa/OvEaAgt\", \"defaultStatus\": \"unaffected\"}], \"solutions\": [{\"lang\": \"en\", \"value\": \"The hotfix can be downloaded from the\\u00a0 Marketplace https://marketplace.opentext.com/itom/content/operations-agent-hotfix-for-cve-2026-2123-privilege-escalation/ \\u00a0for the OA versions mentioned below.\\u00a0\\n\\nPlease follow the readme.txt\\nincluded in the hotfix zip file for\\u00a0install instructions.\\u00a0\\n\\nOA 12.24 - HFWIN_1224028.tar,\\nHFWIN_1224029.tar\\n\\nOA 12.25 -\\nHFWIN_1225045.tar,HFWIN_1225046.tar\\u00a0\\n\\nOA 12.26 - HFWIN_1226039.tar,\\nHFWIN_1226040.tar\\n\\nOA 12.27 - HFWIN_1227023.tar,\\nHFWIN_1227024.tar\\n\\nOA 12.28 - HFWIN_1228020.tar,\\nHFWIN_1228021.tar\\n\\nOA 12.29 - HFWIN_1229006.tar,\\nHFWIN_1229007.tar\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"
The hotfix can be downloaded from the Marketplace for the OA versions mentioned below.
Please follow the readme.txt\\nincluded in the hotfix zip file for install instructions.
OA 12.24 - HFWIN_1224028.tar,\\nHFWIN_1224029.tar
OA 12.25 -\\nHFWIN_1225045.tar,HFWIN_1225046.tar
OA 12.26 - HFWIN_1226039.tar,\\nHFWIN_1226040.tar
OA 12.27 - HFWIN_1227023.tar,\\nHFWIN_1227024.tar
OA 12.28 - HFWIN_1228020.tar,\\nHFWIN_1228021.tar
OA 12.29 - HFWIN_1229006.tar,\\nHFWIN_1229007.tar
\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n
\", \"base64\": false}]}], \"references\": [{\"url\": \"https://portal.microfocus.com/s/article/KM000046068\", \"tags\": [\"customer-entitlement\"]}], \"x_generator\": {\"engine\": \"Vulnogram 1.0.1\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"A security audit identified a privilege escalation\\nvulnerability in Operations Agent(<=OA 12.29) on Windows. Under specific conditions\\nOperations Agent may run executables from specific writeable locations.Thanks to Manuel Rickli & Philippe Leiser of\\nOneconsult AG for reporting this vulnerability\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"
A security audit identified a privilege escalation\\nvulnerability in Operations Agent(<=OA 12.29) on Windows. Under specific conditions\\nOperations Agent may run executables from specific writeable locations.Thanks to Manuel Rickli & Philippe Leiser of\\nOneconsult AG for reporting this vulnerability