Live › vulnerability › CVE-2026-97860
Yamaha YMS-VPN8 and YMS-VPN8-CP provide Windows services registered with unquoted file paths. A local user with write access to the system drive may run arbitrary code with SYSTEM privileges.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 12:24 UTC. All times on this page are UTC.
Windows PCs with Yamaha YMS-VPN8 or YMS-VPN8-CP (VPN client software) at Ver.1.04.00 or earlier. An attacker must already be able to log in or write to the system drive, so shared or multi-user PCs matter most. Not remotely exploitable; other OSes and PCs without the software can skip it.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| YMS-VPN8 | vendor | <= 1.04.00 | 1.07.00 |
| YMS-VPN8-CP | vendor | <= 1.04.00 | 1.07.00 |
sc qc <service name> and look for a BINARY_PATH_NAME that is unquoted and contains spacesUpdate YMS-VPN8 / YMS-VPN8-CP to Ver.1.07.00 (latest from Yamaha's official site).
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
YMS-VPN8 and YMS-VPN8-CP provided by Yamaha Corporation register Windows services with unquoted file paths. A user who has write permissions on the system drive may be able to execute arbitrary code with SYSTEM privileges.
This page as .md · .json · in your agent: get_signal("CVE-2026-97860")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.