Executive brief
OpenText Operations Agent, a tool used for monitoring and managing IT infrastructure, contains a security flaw on Windows systems that allows for privilege escalation. An attacker with low-level access to a system could exploit this to run malicious programs with higher administrative permissions. This could lead to a full system takeover, unauthorized data access, or disruption of monitoring services.
Technical details
A privilege escalation vulnerability exists in OpenText Operations Agent (formerly Micro Focus) versions 12.22 through 12.29 on Windows. The vulnerability, classified under CWE-280, stems from the agent attempting to execute binaries from specific file system locations that are writeable by non-privileged users. A local attacker with low privileges can place a malicious executable in one of these locations to have it executed by the Operations Agent service, which typically runs with SYSTEM or high-level privileges. This allows the attacker to achieve full administrative control over the affected host. The issue is addressed in version 12.30.
Affected products
- OpenText Operations Agent 12.22 through 12.29
Timeline
- 2026-03-31: disclosed
- 2026-03-31: advisory
- 2026-06-17: patched: Version 12.30 identified as unaffected in vendor updates.