CVE-2026-97860
HIGHCVSS 8.4/10
Last modified
CVE-2026-97860 is a high-severity vulnerability rated 8.4/10 on the CVSS scale. YMS-VPN8 and YMS-VPN8-CP provided by Yamaha Corporation register Windows services with unquoted file paths. A user who has write permissions on the system drive may be able to execute arbitrary code with SYSTEM privileges..
Description
YMS-VPN8 and YMS-VPN8-CP provided by Yamaha Corporation register Windows services with unquoted file paths. A user who has write permissions on the system drive may be able to execute arbitrary code with SYSTEM privileges.
Metrics
Weakness Enumeration
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| Yamaha Corporation | YMS-VPN8 | <= Ver.1.04.00 |
| Yamaha Corporation | YMS-VPN8-CP | <= Ver.1.04.00 |
References
Timeline
- Published
- Last Modified
- Status
- Deferred
Frequently Asked Questions
What is CVE-2026-97860?
YMS-VPN8 and YMS-VPN8-CP provided by Yamaha Corporation register Windows services with unquoted file paths. A user who has write permissions on the system drive may be able to execute arbitrary code with SYSTEM privileges.
How severe is CVE-2026-97860?
CVE-2026-97860 has a CVSS score of 8.4/10 (HIGH severity).
How do I fix CVE-2026-97860?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-97851The storage status-change REST service allows location recor…9.1
- CVE-2026-97853Memory Allocation with Excessive Size Value vulnerability in…6.9
- CVE-2026-97854Yamaha wireless LAN router NWR100 provided by Yamaha Corpora…9.8
- CVE-2026-97858An attacker can cause the server to unbind the target device…5.3
- CVE-2026-97859Seven Gitea API routes under `/api/v1/users/{username}` (fol…6.5
- CVE-2026-9786Quest NetVault Backup NVBUDashboard SQL Injection Remote Cod…8.8
- CVE-2026-97863The cisco_firesight_manager_ACL_rule_export module in misp-m…6.3
- CVE-2026-97864A vulnerability has been found in GibbonEdu Gibbon up to 30.…5.3
- CVE-2026-97865A security flaw has been discovered in Open-Web-Analytics up…7.3
- CVE-2026-97866A weakness has been identified in Zhonglun CloudPOS 3.0. Aff…5.6
- CVE-2026-97868A security vulnerability has been detected in sheshbabu zen …3.5
- CVE-2026-97869A flaw has been found in langchain4j up to 1.5.3-beta10/1.11…4.1
Are you affected by CVE-2026-97860?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST