CVE-2026-97860

CVSS 8.4 (high) · published 2026-10-29

YMS-VPN8 and YMS-VPN8-CP provided by Yamaha Corporation register Windows services with unquoted file paths. A user who has write permissions on the system drive may be able to execute arbitrary code with SYSTEM privileges.

Weakness: CWE-428

Source: NVD CVE-2026-97860

References

• https://jvn.jp/en/jp/JVN30675482/
• https://www.rtpro.yamaha.co.jp/RT/FAQ/Security/JVN30675482.html

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.