HIGH 8.4 NVD

CVE-2026-97860

YMS-VPN8 and YMS-VPN8-CP provided by Yamaha Corporation register Windows services with unquoted file paths. A user who has write permissions on the system drive

YMS-VPN8 and YMS-VPN8-CP provided by Yamaha Corporation register Windows services with unquoted file paths. A user who has write permissions on the system drive may be able to execute arbitrary code with SYSTEM privileges.

References

https://jvn.jp/en/jp/JVN30675482/
https://www.rtpro.yamaha.co.jp/RT/FAQ/Security/JVN30675482.html

Published: 2026-10-29 · Source: NVD · Feed updated: 2026-10-29

This high severity vulnerability with a CVSS score of 8.4 was published on 2026-10-29 via NVD.

vulnfeed aggregates 16756 vulnerabilities from NVD, CISA KEV, Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.