{"id":"CVE-2026-97860","published":"2026-10-29T12:17:14.577","lastModified":"2026-10-29T15:45:15.310","description":"YMS-VPN8 and YMS-VPN8-CP provided by Yamaha Corporation register Windows services with unquoted file paths. A user who has write permissions on the system drive may be able to execute arbitrary code with SYSTEM privileges.","cvssScore":6.7,"cvssSeverity":"MEDIUM","cvssVector":"CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-428"],"vendors":[],"products":[],"references":[{"url":"https://jvn.jp/en/jp/JVN30675482/","tags":[]},{"url":"https://www.rtpro.yamaha.co.jp/RT/FAQ/Security/JVN30675482.html","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":null}