Medium severity · published Oct 29, 2026
CVE-2026-97860
YMS-VPN8 and YMS-VPN8-CP provided by Yamaha Corporation register Windows services with unquoted file paths
New
6.7
CVSS
–
EPSS
No
On KEV
Description
YMS-VPN8 and YMS-VPN8-CP provided by Yamaha Corporation register Windows services with unquoted file paths. A user who has write permissions on the system drive may be able to execute arbitrary code with SYSTEM privileges.
CVSS vector
CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
YM
YMS-VPN8 · Yamaha Corporation
through Ver.1.04.00 · source: vendor
YM
YMS-VPN8-CP · Yamaha Corporation
through Ver.1.04.00 · source: vendor