{"id":"CVE-2026-97860","kind":"vulnerability","aliases":["CVE-2026-97860"],"related":[],"title":"Yamaha YMS-VPN8 routers: unquoted Windows service paths allow SYSTEM code execution","description":"YMS-VPN8 and YMS-VPN8-CP provided by Yamaha Corporation register Windows services with unquoted file paths. A user who has write permissions on the system drive may be able to execute arbitrary code with SYSTEM privileges.","summary":"Yamaha YMS-VPN8 and YMS-VPN8-CP provide Windows services registered with unquoted file paths. A local user with write access to the system drive may run arbitrary code with SYSTEM privileges.","severity":"high","cvss":8.4,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"YMS-VPN8","fixed":["1.07.00"],"affected":"<= 1.04.00","ecosystem":"vendor"},{"name":"YMS-VPN8-CP","fixed":["1.07.00"],"affected":"<= 1.04.00","ecosystem":"vendor"}],"ecosystems":[],"tags":["infrastructure","local-privilege-escalation","windows","yamaha","yms-vpn8"],"not_affected_if":["no-local-write-access","product-not-installed","single-trusted-user","version-1.07.00-or-later"],"how_to_check":"- In YMS-VPN8 / YMS-VPN8-CP on Windows, check the installed version: Ver.1.04.00 or earlier is affected, Ver.1.07.00 is fixed\n- List the services with `sc qc <service name>` and look for a BINARY_PATH_NAME that is unquoted and contains spaces","fix":"Update YMS-VPN8 / YMS-VPN8-CP to Ver.1.07.00 (latest from Yamaha's official site).","status":"open","published_at":"2026-10-29T12:17:14+00:00","first_seen_at":"2026-10-29T12:24:39+00:00","triaged_at":"2026-10-29T12:25:27+00:00","updated_at":"2026-10-29T12:26:49+00:00","category":"infrastructure","confidence":0.9,"triage":{"at":"2026-10-29T12:25:27Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Yamaha YMS-VPN8 routers: unquoted Windows service paths allow SYSTEM code execution","impact":"high","summary":"Yamaha YMS-VPN8 and YMS-VPN8-CP provide Windows services registered with unquoted file paths. A local user with write access to the system drive may run arbitrary code with SYSTEM privileges.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["windows","yamaha","yms-vpn8"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"local user gains SYSTEM privileges and runs arbitrary code","analyst_note":"Sources give no affected versions or vendor fix; check the Yamaha advisory and NVD entry for version ranges and remediation.","how_to_check":"- Check whether the Yamaha YMS-VPN8 or YMS-VPN8-CP management software is installed on Windows machines\n- List service paths with `sc qc <service name>` and look for an unquoted path containing spaces\n- Confirm the vendor version for the installed product: unknown","plain_action":"","needs_analyst":true,"not_affected_if":["product-not-installed","no-local-write-access"],"who_is_affected":"Only Windows systems running the Yamaha YMS-VPN8 or YMS-VPN8-CP software are exposed, and the attacker needs write access to the system drive first. Systems without these products can skip it. The sources do not list affected or fixed versions.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000698,"input_tokens":4116,"output_tokens":573,"severity_before":"high"},"analyst_status":"done","analyst_note":"Sources give no affected versions or vendor fix; check the Yamaha advisory and NVD entry for version ranges and remediation.","search":"'-2026':15A,18A '-97860':16A,19A 'abl':102C 'access':59B 'allow':10A 'arbitrari':66B,105C 'code':12A,67B,106C 'corpor':82C 'cp':26A,45B,78C 'cve':14A,17A 'drive':63B,99C 'escal':31B 'execut':13A,104C 'file':52B,88C 'infrastructur':27B 'local':29B,55B 'local-privilege-escal':28B 'may':64B,100C 'path':9A,53B,89C 'permiss':95C 'privileg':30B,70B,109C 'provid':46B,79C 'regist':49B,83C 'router':5A 'run':65B 'servic':8A,48B,85C 'system':11A,62B,69B,98C,108C 'unquot':6A,51B,87C 'user':56B,91C 'vpn8':4A,22A,25A,36B,40B,44B,73C,77C 'window':7A,32B,47B,84C 'write':58B,94C 'yamaha':1A,33B,37B,81C 'yms':3A,21A,24A,35B,39B,43B,72C,76C 'yms-vpn8':2A,20A,34B,38B,71C 'yms-vpn8-cp':23A,42B,75C","nicknames":[],"mitigations":[],"who_affected":"Windows PCs with Yamaha YMS-VPN8 or YMS-VPN8-CP (VPN client software) at Ver.1.04.00 or earlier. An attacker must already be able to log in or write to the system drive, so shared or multi-user PCs matter most. Not remotely exploitable; other OSes and PCs without the software can skip it.","tier":"B","verified":{"fix":{"at":"2026-10-29T12:26:49Z","by":"analyst","doc":"https://www.rtpro.yamaha.co.jp/RT/utility/YMS-VPN8/ReleaseNote_ver.1.07.00.html","run_id":1020},"products":{"at":"2026-10-29T12:26:49Z","by":"analyst","doc":"https://www.rtpro.yamaha.co.jp/RT/utility/YMS-VPN8/ReleaseNote_ver.1.07.00.html","run_id":1020},"how_to_check":{"at":"2026-10-29T12:26:49Z","by":"analyst","doc":"https://www.rtpro.yamaha.co.jp/RT/utility/YMS-VPN8/ReleaseNote_ver.1.07.00.html","run_id":1020},"who_affected":{"at":"2026-10-29T12:26:49Z","by":"analyst","doc":"https://www.rtpro.yamaha.co.jp/RT/utility/YMS-VPN8/ReleaseNote_ver.1.07.00.html","run_id":1020}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"first_public_at":"2026-10-29T12:17:14+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"vultures@jpcert.or.jp","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-97860","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-97860","severity":null,"published_at":"2026-10-29T12:17:14+00:00","modified_at":"2026-10-29T12:17:14+00:00","first_seen_at":"2026-10-29T12:24:39+00:00","fetched_at":"2026-10-29T12:24:39+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-97860:1020","url":null,"severity":null,"published_at":"2026-10-29T12:26:49+00:00","modified_at":"2026-10-29T12:26:49+00:00","first_seen_at":"2026-10-29T12:26:49+00:00","fetched_at":"2026-10-29T12:26:49+00:00","note":"Yamaha FAQ + JVN#30675482 + 1.07.00 release note: affected <=1.04.00, fixed 1.07.00. Local only, not exploited; no PoC. Vendor workaround if no update: don't share the PC, no untrusted logins, no needless admin rights, don't run unknown files."}],"documents":[{"id":16408,"url":"https://www.rtpro.yamaha.co.jp/RT/FAQ/Security/JVN30675482.html","title":"Yamaha RT FAQ: YMS-VPN8 unquoted file path (JVN#30675482)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":16409,"url":"https://jvn.jp/en/jp/JVN30675482/","title":"JVN#30675482 Yamaha YMS-VPN8 unquoted file paths","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":16410,"url":"https://www.rtpro.yamaha.co.jp/RT/utility/YMS-VPN8/ReleaseNote_ver.1.07.00.html","title":"YMS-VPN8 Ver.1.07.00 release note","kind":"release","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"fix","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}