A vulnerability in HP One Agent for certain HP PC products could allow an attacker to elevate privileges or execute arbitrary code. The flaw is linked to improper handling of executable paths, permitting a process with restricted rights to run code with higher privileges or uncontrolled user input. The potential outcome is full system compromise, data disclosure, or further exploitation of the host. The weakness is classified under CWE‑427.

HP One Agent Software installed on HP PCs is impacted. The vendor, HP Inc., has released a security update, but specific affected product versions are not listed in the advisory. Systems running older or unpatched HP One Agent legacy components on Windows operating systems may be vulnerable.

The CVSS score of 8.5 indicates high severity. No EPSS score is available, and the vulnerability is not in CISA’s KEV catalog. The likely attack vector is local or through a compromised user process, given the requirement to execute code with elevated privileges. To exploit the flaw, an attacker would need to run code that manipulates the execution path in a privileged context.