CVE-2026-97860

YMS-VPN8 and YMS-VPN8-CP provided by Yamaha Corporation register Windows services with unquoted…

Risk score: 50/100
CVSS: 8.4 v4.0
Published: 29 Oct 2026

Open in the live forecast Today's forecast

What to know

What it is: YMS-VPN8 and YMS-VPN8-CP provided by Yamaha Corporation register Windows services with unquoted file paths. A user who has write permissions on the system drive may be able to execute arbitrary code with SYSTEM privileges.
Affected: See advisory
Fix: Apply the vendor's security update; see the linked advisory.
Exploitation: No known exploitation

Why it is Yellow

CVSS 8.4 high

References

https://jvn.jp/en/jp/JVN30675482/
https://www.rtpro.yamaha.co.jp/RT/FAQ/Security/JVN30675482.html

Original description

YMS-VPN8 and YMS-VPN8-CP provided by Yamaha Corporation register Windows services with unquoted file paths. A user who has write permissions on the system drive may be able to execute arbitrary code with SYSTEM privileges.

Last activity 29 Oct 2026. Patch Forecast updates every hour.