CVE-2026-5064: HP One Agent Privilege Escalation Flaw

CVE-2026-5064 Overview

CVE-2026-5064 affects the HP One Agent installed on certain HP PC products. The vulnerability stems from an uncontrolled search path element [CWE-427], commonly exploited through DLL search-order hijacking. A local authenticated attacker can leverage the flaw to escalate privileges or trigger a denial-of-service condition on the host. HP has published software updates to address the issue.

Critical Impact
Local low-privileged users can achieve privilege escalation on affected HP PCs, gaining high-impact compromise of confidentiality, integrity, and availability on the targeted endpoint.

Affected Products

HP One Agent on certain HP PC products
See the HP Security Advisory for the full list of impacted models and versions

Discovery Timeline

2026-06-15 - CVE-2026-5064 published to NVD
2026-06-18 - Last updated in NVD database

Technical Details for CVE-2026-5064

Vulnerability Analysis

The HP One Agent runs on HP PC endpoints to provide telemetry and management functions. HP's advisory classifies the flaw under [CWE-427] Uncontrolled Search Path Element. The agent loads one or more libraries from a search path that a local user can influence. Because the agent typically executes with elevated privileges, a planted library is loaded in a higher-privileged security context. Successful exploitation yields code execution as the agent's service account or causes the agent to terminate, producing a denial-of-service condition. The attack requires local access and low-level privileges, with no user interaction beyond the attacker's own session.

Root Cause

The root cause is an uncontrolled library or component search path used by the HP One Agent. When the agent resolves a dependency, the operating system loader consults directories that a standard user can write to before locating the legitimate binary. An attacker drops a malicious library matching the expected name into one of these locations. The agent then loads the attacker-controlled module rather than the intended one.

Attack Vector

Exploitation is local. An attacker with an interactive session and standard user privileges places a crafted library in a writable location resolved by the agent's search path. Triggering the load occurs when the HP One Agent starts, restarts, or invokes a vulnerable code path. The library executes inside the agent's privileged process, providing privilege escalation. Alternatively, a malformed library forces the agent to crash, denying the management and security functions it provides. No network access is required, and authentication is limited to local logon.

Detection Methods for CVE-2026-5064

Indicators of Compromise

Unexpected DLL or shared library files in directories adjacent to the HP One Agent executable or in user-writable directories on the system search path
Unsigned or mismatched-publisher modules loaded by the HP One Agent service process
HP One Agent service crashes, restarts, or abnormal termination events logged in the Windows Event Log
Child processes spawned by the HP One Agent service that do not match HP-signed binaries

Detection Strategies

Inventory loaded modules for the HP One Agent process and compare publisher signatures against the expected HP Inc. code-signing certificate
Hunt for file-creation events targeting directories used by the agent's load path, especially writes performed by non-administrative users
Alert on privilege-elevation patterns where a process originating from a standard user session leads to code execution under the agent's service account

Monitoring Recommendations

Forward Sysmon Event ID 7 (image loaded) and Event ID 11 (file create) from HP endpoints to a central log platform for analysis
Track service start, stop, and crash events for the HP One Agent service to detect denial-of-service attempts
Validate the integrity of HP One Agent installation directories against a known-good baseline on a recurring schedule

How to Mitigate CVE-2026-5064

Immediate Actions Required

Apply the HP One Agent updates referenced in the HP Security Advisory across all affected HP PCs
Identify impacted endpoints by querying installed HP One Agent versions through your endpoint management platform
Restrict local logon rights on shared and high-value workstations to limit who can stage a local attack

Patch Information

HP has released software updates that remediate the uncontrolled search path issue in the HP One Agent. Refer to the HP Security Advisory for fixed version numbers and download locations specific to each affected HP PC product line.

Workarounds

Remove write permissions for standard users on any directory present in the HP One Agent's library search path
Enforce application control policies that block execution of unsigned libraries from user-writable paths
Temporarily disable the HP One Agent service on systems where patching cannot be performed immediately, accepting the loss of associated management functionality

bash

# Query installed HP One Agent version on Windows endpoints (PowerShell)
Get-CimInstance -ClassName Win32_Product |
  Where-Object { $_.Name -like 'HP One Agent*' } |
  Select-Object Name, Version, Vendor