CVE-2024-0622 is a high severity privilege escalation flaw in OpenText Operations Agent, scored CVSS 8.8. The record lists OpenText (formerly Micro Focus) Operations Agent versions 12.15 and 12.20 through 12.25 when installed on non-Windows platforms. The record gives no fixed version.
What's affected
The record lists OpenText (formerly Micro Focus) Operations Agent versions 12.15 and 12.20 through 12.25 when installed on non-Windows platforms.
The CVSS vector in the record is CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, with a base score of 8.8 (High). KEV status: not listed in the record.
Fixed version: The record gives no fixed version. Follow the vendor knowledge base article KM000026555 in the references.
How to check if you're exposed
On each non-Windows host, list the installed Operations Agent version using the vendor tooling or the package manager, for example the package query for your platform. Versions 12.15 and 12.20 through 12.25 are named in the record. Your configuration management inventory is the fastest way to find them across hosts.
What to do now
- Find all non-Windows hosts running the affected Operations Agent versions.
- Apply the vendor fix from the knowledge base article.
- Limit local login to the hosts to people who need it.
- Rescan to confirm the finding closes.
Why it matters
CWE-269 describes this class. Improper privilege management means the product does not correctly limit what a local account can gain. A low privilege user can end up with rights that belong to a higher one. Agents that run as root deserve extra scrutiny of file permissions and helper programs.
The record does not mark this CVE as exploited in the wild, and it is not in the CISA KEV catalog. Published 2024-02-15.
Safeguard Gold keeps a page for this CVE at gold.safeguard.sh, and the free in-browser dependency scan can show whether software you build bundles related components.
Local privilege and local code execution flaws are easy to underrate because they need a foothold first. In practice a foothold is often the second step of an intrusion, so these bugs decide how far an attacker can go after phishing or a stolen password. Treat them as part of defence in depth and patch them on a normal schedule, sooner on shared or high value hosts.
Quick check
Is CVE-2024-0622 exploited in the wild?
The record's KEV flag is false, and none of the pages I fetched said otherwise. That is not proof of safety, so still patch or restrict access.
Does this affect Windows hosts?
The record says non-Windows platforms. Windows installs are not named.
Sources
- Safeguard Gold entry for CVE-2024-0622
- NVD record data for CVE-2024-0622, including the references listed there (the other reference pages were not fetched for this post).
Last reviewed: 19 October 2026.
