CVE-2026-2123
Published: 31 March 2026
Summary
CVE-2026-2123 is a high-severity Improper Handling of Insufficient Permissions or Privileges (CWE-280) vulnerability in Microfocus Operations Agent. Its CVSS base score is 8.6 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 1.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SC-34 (Non-modifiable Executable Programs) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2026-2123 is a privilege escalation vulnerability affecting Operations Agent versions 12.29 and earlier on Windows. A security audit identified that under specific conditions, the Operations Agent may execute binaries from certain writable locations, enabling unauthorized elevation of privileges. The issue carries a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and maps to CWE-280: Improper Handling of Insufficient Privileges or Ownership Validation. It was reported by Manuel Rickli and Philippe Leiser of Oneconsult AG.
A local attacker with low privileges (PR:L) can exploit this vulnerability with low attack complexity and no user interaction. Exploitation involves leveraging the agent's behavior to run executables from writable directories, potentially achieving high impacts on confidentiality, integrity, and availability through privilege escalation.
The vendor advisory, available at https://portal.microfocus.com/s/article/KM000046068, details mitigation steps and patches for addressing the vulnerability in affected Operations Agent installations.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-17534
Vulnerability details
A security audit identified a privilege escalation vulnerability in Operations Agent(<=OA 12.29) on Windows. Under specific conditions Operations Agent may run executables from specific writeable locations.Thanks to Manuel Rickli & Philippe Leiser of Oneconsult AG for reporting this vulnerability
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Local privilege escalation via agent executing binaries from insecure writable paths directly matches T1068.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Prevents the Operations Agent from executing binaries from writable locations by restricting execution to non-modifiable executable programs.
Timely flaw remediation through vendor patches directly corrects the privilege escalation vulnerability stemming from improper execution path validation.
Enforces least privilege on the Operations Agent process, limiting the potential impact and scope of any privilege escalation from executed code in writable directories.