How severe is CVE-2026-2123?

CVE-2026-2123 has a CVSS 3.x base score of 7.8, rated high severity. It is exploitable over local access with low attack complexity, requires low privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability high.

Is CVE-2026-2123 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (1st percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2026-2123?

CVE-2026-2123 affects Microfocus Operations Agent. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2026-2123?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.

Does CVE-2026-2123 have an EU (EUVD) identifier?

Yes. CVE-2026-2123 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2026-17534.

When was CVE-2026-2123 published?

CVE-2026-2123 was published on 2026-03-31 and last updated on 2026-06-17.

CVE-2026-2123

CVE-2026-2123 is a high-severity vulnerability in Microfocus Operations Agent with a CVSS 3.x base score of 7.8. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-280.

Key facts

Severity: High (CVSS 3.x base score 7.8)
CVSS v4: 8.6
EPSS exploit prediction: 0% (1st percentile)
Actively exploited: Not listed in CISA KEV
EU (EUVD) id: EUVD-2026-17534
Weakness: CWE-280
Affected product: Microfocus Operations Agent
Published: 2026-03-31
Last modified: 2026-06-17

Description

A security audit identified a privilege escalation vulnerability in Operations Agent(<=OA 12.29) on Windows. Under specific conditions Operations Agent may run executables from specific writeable locations.Thanks to Manuel Rickli & Philippe Leiser of Oneconsult AG for reporting this vulnerability

Frequently asked questions

What is CVE-2026-2123?: A security audit identified a privilege escalation vulnerability in Operations Agent(<=OA 12.29) on Windows. Under specific conditions Operations Agent may run executables from specific writeable locations.Thanks to Manuel Rickli & Philippe Leiser of Oneconsult AG for reporting this vulnerability
How severe is CVE-2026-2123?: CVE-2026-2123 has a CVSS 3.x base score of 7.8, rated high severity. It is exploitable over local access with low attack complexity, requires low privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability high.
Is CVE-2026-2123 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (1st percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2026-2123?: CVE-2026-2123 affects Microfocus Operations Agent. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2026-2123?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.
Does CVE-2026-2123 have an EU (EUVD) identifier?: Yes. CVE-2026-2123 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2026-17534.
When was CVE-2026-2123 published?: CVE-2026-2123 was published on 2026-03-31 and last updated on 2026-06-17.

References

https://portal.microfocus.com/s/article/KM000046068

Affected products (1)

cpe:2.3:a:microfocus:operations_agent:*:*:*:*:*:*:*:*

More vulnerabilities in Microfocus Operations Agent

CVE-2021-22505 — Critical (CVSS 9.8): Escalation of privileges vulnerability in Micro Focus Operations Agent, affects versions 12.0x, 12.10, 12.11, 12.12,…
CVE-2024-0622 — High (CVSS 8.8): Local privilege escalation vulnerability affects OpenText Operations Agent product versions 12.15 and 12.20-12.25 when…
CVE-2020-11861 — High (CVSS 7.8): Unauthorized escalation of local privileges vulnerability on Micro Focus Operation Agent, affecting all versions prior…
CVE-2019-17085 — Medium (CVSS 6.5): XXE attack vulnerability on Micro Focus Operations Agent, affected version 12.0, 12.01, 12.02, 12.03, 12.04, 12.05,…
CVE-2024-5532 — Medium (CVSS 4.8): Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in…
CVE-2021-38129 — Low (CVSS 3.3): Escalation of privileges vulnerability in Micro Focus in Micro Focus Operations Agent, affecting versions 12.x up to…

All CVEs affecting Microfocus Operations Agent →

Other CWE-280 vulnerabilities

CVE-2025-46066 — Critical (CVSS 9.9): An issue in Automai Director v.25.2.0 allows a remote attacker to escalate privileges
CVE-2025-6573 — Critical (CVSS 9.8): Kernel software installed and running inside an untrusted/rich execution environment (REE) could leak information from…
CVE-2024-24116 — Critical (CVSS 9.8): An issue in Ruijie RG-NBS2009G-P RGOS v.10.4(1)P2 Release(9736) allows a remote attacker to gain privileges via the…
CVE-2026-41566 — Critical (CVSS 9.4): Improper Handling of Insufficient Permissions or Privileges vulnerability in Apache Kvrocks. This issue affects Apache…
CVE-2024-1608 — Critical (CVSS 9.1): In OPPO Usercenter Credit SDK, there's a possible escalation of privilege due to loose permission check, This could…
CVE-2026-24096 — High (CVSS 8.8): Insufficient permission validation on multiple REST API Quick Setup endpoints in Checkmk 2.5.0 (beta) before version…

Browse all CWE-280 vulnerabilities →