CVE-2025-26860 Overview
CVE-2025-26860 is an uncontrolled search path element vulnerability [CWE-427] affecting the RemoteCall Remote Support Program (for Operator). All versions prior to 5.1.0 are vulnerable. An attacker who places a crafted Dynamic Link Library (DLL) in the same folder as the affected product can trigger arbitrary code execution when the application loads the malicious library. The flaw requires local access and user interaction, but execution occurs in the context of the user running the support program.
Critical Impact
A crafted DLL placed alongside the RemoteCall executable can hijack the application's library loading process and execute attacker-controlled code with the privileges of the operator.
Affected Products
- RemoteCall Remote Support Program (for Operator) versions prior to 5.1.0
- Windows installations of the RemoteCall operator client
- Endpoints where the RemoteCall executable resides in a writable directory
Discovery Timeline
- 2025-10-15 - CVE-2025-26860 published to the National Vulnerability Database (NVD)
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-26860
Vulnerability Analysis
The vulnerability is classified as an uncontrolled search path element [CWE-427], commonly referred to as DLL search order hijacking or DLL preloading. The RemoteCall Remote Support Program does not enforce a fully qualified path when loading one or more of its required DLLs. Windows resolves unqualified DLL names through a defined search order that includes the application's working directory.
When the application starts, it searches adjacent directories for required libraries before consulting trusted system locations. An attacker who can write a file into the same folder as the RemoteCall executable can stage a malicious DLL using the expected name. The application loads the attacker DLL and executes its DllMain entry point during process initialization, resulting in arbitrary code execution under the operator account.
Root Cause
The root cause is improper control of the library search path used by the RemoteCall operator binary. The application relies on Windows default search behavior instead of calling SetDefaultDllDirectories or specifying absolute paths through LoadLibraryEx with the LOAD_LIBRARY_SEARCH_SYSTEM32 flag. This allows untrusted directories to take precedence over system locations during library resolution.
Attack Vector
Exploitation requires local access and user interaction. A typical attack chain involves social engineering the operator into running the RemoteCall executable from a directory the attacker controls, such as a download folder, removable media, or a shared network location seeded with a malicious DLL. When the operator launches the program, the planted DLL is loaded automatically, and the attacker's code runs with the operator's privileges. Confidentiality, integrity, and availability of the host are all impacted because the payload executes inside the trusted application process.
No verified public proof-of-concept code is available for this CVE. Refer to the JVN Security Advisory for vendor technical details.
Detection Methods for CVE-2025-26860
Indicators of Compromise
- Unsigned or unexpected DLL files present in the same directory as the RemoteCall operator executable.
- Recently created DLLs in user-writable folders such as Downloads, Desktop, or removable drives where the RemoteCall binary is being run.
- Process telemetry showing the RemoteCall operator process loading modules from non-standard paths outside of C:\Program Files or C:\Windows\System32.
Detection Strategies
- Monitor image-load events (Sysmon Event ID 7) for the RemoteCall operator process and alert on DLLs loaded from user-writable directories.
- Generate file integrity alerts when new DLLs appear adjacent to known RemoteCall executables.
- Correlate process creation events with subsequent suspicious child processes, network connections, or LOLBin activity originating from the RemoteCall process.
Monitoring Recommendations
- Inventory all endpoints with RemoteCall installed and verify the installed version against 5.1.0 or later.
- Track operator behavior of launching RemoteCall from non-standard installation paths and treat these executions as high-risk.
- Audit signed binary policies to ensure only DLLs signed by the legitimate vendor are loaded by the RemoteCall process.
How to Mitigate CVE-2025-26860
Immediate Actions Required
- Upgrade the RemoteCall Remote Support Program (for Operator) to version 5.1.0 or later from the RemoteCall Download Page.
- Restrict execution of the RemoteCall operator binary to a trusted installation directory such as C:\Program Files\RemoteCall and prevent users from running it from arbitrary locations.
- Remove any unauthorized or unsigned DLLs discovered alongside the RemoteCall executable on managed endpoints.
Patch Information
The vendor addressed CVE-2025-26860 in RemoteCall Remote Support Program (for Operator) version 5.1.0. See the JVN Security Advisory for vendor coordination details and updated installer downloads.
Workarounds
- Instruct operators to launch RemoteCall only from its installed location and never from downloads or shared folders.
- Apply application control or AppLocker policies that block DLL loading from user-writable directories.
- Enforce Windows DLL search path hardening through the CWDIllegalInDllSearch registry value to remove the current working directory from the DLL search order.
# Configuration example: harden DLL search path on Windows hosts running RemoteCall
reg add "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager" /v CWDIllegalInDllSearch /t REG_DWORD /d 0xFFFFFFFF /f
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
