CVE-2026-2123: 
Micro Focus Operations Agent vulnerability analysis and mitigation

CVE-2026-2123 is a privilege escalation vulnerability in OpenText (formerly Micro Focus) Operations Agent on Windows, affecting versions 12.22 through 12.29 (inclusive). Under specific conditions, the agent may execute binaries from user-writable directory locations, enabling unauthorized privilege elevation. The vulnerability was discovered through a security audit conducted by Manuel Rickli and Philippe Leiser of Oneconsult AG and was publicly disclosed on March 31, 2026. It carries a CVSS v3.1 base score of 7.8 (High) and a CVSS v4.0 base score of 8.6 (High) (GitHub Advisory, Micro Focus Advisory).

The root cause is classified as CWE-280 (Improper Handling of Insufficient Permissions or Privileges), where the Operations Agent service fails to adequately validate the integrity or permission level of directories from which it loads and executes binaries (GitHub Advisory). An attacker with low-privileged local access can place a malicious executable in a writable directory that the agent references during its operation, causing the agent — which likely runs with elevated system privileges — to execute the attacker-controlled binary. Exploitation requires local access and some degree of passive user interaction (e.g., a service restart or scheduled task trigger), but no special attack complexity beyond identifying the vulnerable writable path (Micro Focus Advisory).

Successful exploitation allows a low-privileged local user to execute arbitrary code with the elevated privileges of the Operations Agent service, potentially achieving full system compromise. All three security pillars are affected at high severity: confidentiality (access to sensitive data), integrity (unauthorized modification of system files or configurations), and availability (disruption of services). The CVSS v4.0 scoring also indicates high impact on subsequent systems, suggesting potential for lateral movement within monitored environments where Operations Agent has broad network visibility (GitHub Advisory).

There is no public proof-of-concept exploit code and no evidence of in-the-wild exploitation at this time (Feedly). The EPSS score is approximately 0.013–0.018%, placing it in a low percentile for near-term exploitation probability. The vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires local access with low privileges, which limits the attack surface compared to remotely exploitable vulnerabilities.

1. Reconnaissance: Identify Windows hosts running OpenText/Micro Focus Operations Agent versions 12.22–12.29 within the target environment, using installed software enumeration tools (e.g., wmic product get name,version or PowerShell Get-WmiObject).
2. Identify writable directories: Enumerate directories that the Operations Agent service references for executable loading using tools like Process Monitor (Procmon) or by reviewing service configuration files, looking for paths writable by low-privileged users.
3. Place malicious executable: Write a crafted executable (e.g., a reverse shell or privilege-escalating payload) into the identified writable directory, naming it to match the expected binary the agent attempts to load.
4. Trigger execution: Wait for or trigger the condition under which Operations Agent loads executables from that directory (e.g., service restart, scheduled task, or specific agent operation), causing the agent to execute the attacker-controlled binary with elevated privileges.
5. Achieve privilege escalation: The malicious binary executes in the context of the Operations Agent service account (typically SYSTEM or a high-privileged account), granting the attacker full control of the host (GitHub Advisory, Micro Focus Advisory).

• File System: Unexpected or newly created executables (.exe, .dll) in directories writable by standard users that are referenced by the Operations Agent service; file timestamps inconsistent with legitimate software installation.
• Process: Unusual child processes spawned by the Operations Agent process (e.g., cmd.exe, powershell.exe, reverse shell binaries) with a parent process belonging to the OA service.
• Logs: Windows Event Log entries (Event ID 4688 – Process Creation) showing the Operations Agent service launching unexpected executables from non-standard or user-writable paths; Windows Service Control Manager logs showing unexpected service restarts.
• Network: Outbound connections from the Operations Agent host to unknown external IPs or internal lateral movement targets initiated by the agent process or its children.

OpenText has published a vendor advisory (KM000046068) addressing this vulnerability; administrators should consult the advisory for patched version details and apply available updates promptly (Micro Focus Advisory). As an immediate workaround, audit and restrict write permissions on all directories accessed by the Operations Agent service so that only SYSTEM or administrator accounts can write to those paths. Implement file integrity monitoring (FIM) on Operations Agent installation and working directories, and apply the principle of least privilege to user accounts on affected Windows hosts. Where possible, isolate or temporarily disable Operations Agent deployments on high-value systems until patching is confirmed.

The vulnerability was responsibly disclosed by Manuel Rickli and Philippe Leiser of Oneconsult AG following a security audit, and OpenText acknowledged their contribution in the official advisory (Micro Focus Advisory). No significant broader media coverage, vendor blog posts, or notable researcher commentary beyond the initial disclosure have been identified at this time.