A privilege escalation flaw allows the Operations Agent to run executables from writable locations. If an attacker can place a malicious file in such a location, the agent will execute it with the permissions of the agent process, potentially allowing full system compromise on Windows and affecting confidentiality, integrity and availability.

Affected are OpenText Operations Agent installations on Windows, versions 12.24 through 12.29. The flaw exists in all releases up to and including 12.29.

The CVSS score of 8.6 classifies the flaw as high severity. The EPSS score of less than 1 percent indicates that active exploitation is expected to be rare, and the vulnerability is not listed in the CISA KEV catalog. The likely attack path is local: an attacker with write access to a directory that Operations Agent scans for executables. If such access can be obtained, the flaw can be leveraged to gain the agent’s privileges, which may be elevated on the system. Because the attack requires the agent to be running and a writable location, the risk is significant in environments where the agent runs under high‑privilege accounts or where directory permissions are lax.