CVE-2026-97860: Medium severity Yamaha YMS-VPN8 vulnerability
YMS-VPN8 and YMS-VPN8-CP provided by Yamaha Corporation register Windows services with unquoted file paths. A user who has write permissions on the system drive may be able to execute arbitrary code with SYSTEM privileges.
Affected Software
Event History
Frequently Asked Questions
Who is realistically exposed to this issue?
Systems running Yamaha YMS-VPN8 or Yamaha YMS-VPN8-CP are affected if a user has write permission on the system drive. Exploitation also requires high privileges, as reflected by the PR:H vector.
What does an attacker need to exploit the vulnerability?
An attacker needs local access and write permissions on the system drive. They can then place or control a program in a location that is selected because the affected Windows service path is unquoted, potentially resulting in execution with SYSTEM privileges.
How can I determine whether my system is affected?
Check whether Yamaha YMS-VPN8 or YMS-VPN8-CP is installed and whether its Windows services use unquoted executable paths. Also assess whether non-administrative or otherwise untrusted users can write to the system drive.