CVE-2026-24466: Oki Electric Unquoted Path RCE Vulnerability

CVE-2026-24466 Overview

CVE-2026-24466 is a privilege escalation vulnerability affecting products from Oki Electric Industry Co., Ltd. and its OEM partners including Ricoh Co., Ltd. and Murata Machinery, Ltd. The vulnerability exists because Windows services are registered with unquoted file paths, allowing a user with write permission on the root directory of the system drive to execute arbitrary code with SYSTEM privileges.

Critical Impact

Local attackers with write access to the system drive root directory can achieve SYSTEM-level privilege escalation through unquoted service path exploitation.

Affected Products

• Oki Electric Industry Co., Ltd. printing products
• Ricoh Co., Ltd. OEM products
• Murata Machinery, Ltd. OEM products

Discovery Timeline

• 2026-02-09 - CVE-2026-24466 published to NVD
• 2026-02-09 - Last updated in NVD database

Technical Details for CVE-2026-24466

Vulnerability Analysis

This vulnerability is classified as CWE-428 (Unquoted Search Path or Element), a well-known Windows misconfiguration that occurs when services are registered with executable paths containing spaces without proper quotation marks. When Windows attempts to start such a service, it parses the unquoted path and may execute a malicious binary placed in a location that appears earlier in the path resolution order.

The vulnerability requires local access and high privileges (specifically, write access to the system drive root directory). However, once exploited, an attacker can achieve code execution with SYSTEM privileges, representing a complete compromise of system integrity and confidentiality on the affected host.

Root Cause

The root cause is improper service registration in Windows where the executable path is not enclosed in quotation marks. For example, if a service points to C:\Program Files\Oki Printer\Service.exe, Windows will attempt to execute in this order:

1. C:\Program.exe
2. C:\Program Files\Oki.exe
3. C:\Program Files\Oki Printer\Service.exe

If an attacker can place a malicious executable at C:\Program.exe or another location in the path resolution sequence, it will be executed with the service's privileges (typically SYSTEM).

Attack Vector

The attack requires local access to the system where the vulnerable software is installed. An attacker must have write permissions to the root directory of the system drive (typically C:\) or another directory in the unquoted path. By placing a specially crafted executable in the path, the attacker can hijack the service startup process and execute arbitrary code with SYSTEM-level privileges.

The attack vector is local, requiring the attacker to already have some level of access to the system. This vulnerability is often chained with other exploits or used by insiders to escalate privileges beyond their normal access level.

Detection Methods for CVE-2026-24466

Indicators of Compromise

• Unexpected executable files in the root of the system drive (e.g., C:\Program.exe)
• Suspicious binaries in directories matching partial paths of legitimate service executables
• Unusual process execution chains where services spawn unexpected child processes
• Event log entries showing service failures or unexpected service restarts

Detection Strategies

• Query Windows services for unquoted paths using PowerShell: Get-WmiObject win32_service | Where-Object {$_.PathName -notlike '"*"' -and $_.PathName -like '* *'}
• Monitor file creation events in the system drive root directory and C:\Program Files\ parent directories
• Deploy endpoint detection rules for executables created in suspicious locations
• Implement SentinelOne behavioral AI to detect privilege escalation patterns

Monitoring Recommendations

• Enable Windows Security Event logging for service creation and modification (Event ID 7045)
• Monitor for process creation events where parent process is a service and child is an unexpected executable
• Configure file integrity monitoring on the system drive root directory
• Use SentinelOne's real-time monitoring to detect and block unauthorized executables in sensitive directories

How to Mitigate CVE-2026-24466

Immediate Actions Required

• Apply vendor-supplied patches from Oki Electric Industry, Ricoh, or Murata Machinery as applicable
• Audit all installed services for unquoted paths and remediate where possible
• Restrict write permissions on the system drive root directory to administrative accounts only
• Deploy endpoint protection solutions capable of detecting privilege escalation attempts

Patch Information

Vendor advisories and patches are available from the following sources:

• Oki Product Security Advisory
• Oki Important Information Update
• Ricoh Vulnerability Advisory
• Muratec Security Announcement
• JVN Security Advisory

Contact your vendor or OEM partner for specific patch instructions for your installed products.

Workarounds

• Remove write permissions from non-administrative users on the system drive root directory
• Manually correct unquoted service paths by adding quotation marks in the Windows Registry under HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\
• Implement application whitelisting to prevent unauthorized executables from running
• Use Windows Defender Application Control (WDAC) or AppLocker policies to restrict executable locations

# PowerShell command to identify vulnerable services with unquoted paths
Get-WmiObject win32_service | Where-Object {$_.PathName -notlike '"*"' -and $_.PathName -like '* *'} | Select-Object Name, PathName