CVE-2026-28267: i-Filter Privilege Escalation Flaw

CVE-2026-28267 Overview

CVE-2026-28267 is an Insecure Permissions vulnerability affecting multiple i-フィルター (i-Filter) products. The affected products are configured with improper file access permission settings, allowing non-administrative users to create or overwrite files in system directories or backup directories. This vulnerability could enable local attackers to manipulate critical system files, potentially leading to system compromise or data integrity issues.

Critical Impact

Local attackers with low privileges can create or overwrite files in sensitive system and backup directories, potentially leading to unauthorized system modifications or denial of service conditions.

Affected Products

• i-フィルター products (multiple versions)
• Systems managed via Mobi-Connect IFilter
• Deployments integrated with Optim Co. management systems

Discovery Timeline

• March 10, 2026 - CVE-2026-28267 published to NVD
• March 11, 2026 - Last updated in NVD database

Technical Details for CVE-2026-28267

Vulnerability Analysis

This vulnerability stems from CWE-276 (Incorrect Default Permissions), a common security weakness where software installs files or directories with insecure permissions. In the case of CVE-2026-28267, multiple i-フィルター products fail to properly restrict file access permissions on critical system and backup directories.

The local attack vector requires an attacker to have an existing low-privilege account on the target system. Once authenticated, the attacker can exploit the permissive file system access controls to write arbitrary files to protected directories. This could enable various attack scenarios including DLL hijacking, configuration tampering, or planting malicious executables in system paths.

The vulnerability affects the integrity of the system without directly impacting confidentiality or availability, though secondary effects could lead to broader system compromise depending on what files an attacker chooses to manipulate.

Root Cause

The root cause of CVE-2026-28267 is improper configuration of file system permissions during product installation or runtime. The i-フィルター products create or manage directories with overly permissive access control lists (ACLs), allowing users without administrative privileges to write to locations that should be restricted to system administrators only.

This typically occurs when:

• Installation routines fail to properly set restrictive permissions on created directories
• Directory permissions are inherited from parent folders with insecure settings
• The software explicitly grants write access to non-privileged user groups

Attack Vector

The attack requires local access to the system with a valid low-privilege user account. An attacker would need to:

1. Identify the vulnerable i-フィルター installation on the target system
2. Locate the misconfigured system or backup directories
3. Create or overwrite files within these directories to achieve their objective

The vulnerability does not require user interaction and has low attack complexity once local access is obtained. Potential exploitation scenarios include placing malicious binaries in system paths, modifying configuration files to alter application behavior, or corrupting backup data to prevent system recovery.

For detailed technical analysis, refer to the JVN Security Notification JVN17307628 and vendor-provided security bulletins available from DAJ Information Download #1.

Detection Methods for CVE-2026-28267

Indicators of Compromise

• Unexpected file creation or modification events in i-フィルター system directories
• New or modified files in backup directories with timestamps inconsistent with scheduled operations
• Presence of executable files or DLLs in system directories that were not part of the original installation
• File ownership changes indicating non-administrative user activity in protected directories

Detection Strategies

• Monitor file system integrity using tools like SentinelOne's Real-Time File Integrity Monitoring to detect unauthorized changes to i-フィルター directories
• Implement Windows Security Event auditing for Object Access (Event IDs 4656, 4663) on vulnerable directories
• Deploy endpoint detection rules to alert on file creation by non-SYSTEM accounts in program installation directories
• Use behavioral analysis to identify privilege escalation attempts following file manipulation in system paths

Monitoring Recommendations

• Enable detailed file system auditing on all directories associated with i-フィルター installations
• Configure SentinelOne Singularity Platform to monitor for suspicious file operations in %ProgramFiles% and backup directory paths
• Establish baseline file inventories for i-フィルター installations to quickly identify unauthorized additions
• Implement alerts for any write operations to system directories by standard user accounts

How to Mitigate CVE-2026-28267

Immediate Actions Required

• Review and audit current file permissions on all i-フィルター installation directories and backup locations
• Restrict directory permissions to allow write access only to SYSTEM and Administrator accounts
• Check for any unauthorized files that may have been created in vulnerable directories
• Update affected i-フィルター products to patched versions as detailed in vendor advisories

Patch Information

Affected users should consult the official vendor security advisories for patch availability and installation instructions:

• DAJ Information Download #1 - Primary security bulletin
• DAJ Information Download #2 - Additional information
• Fujitsu Knowledge Base Article - Windows release notes
• Mobi-Connect IFilter Resource - Updated installation files

Workarounds

• Manually correct directory permissions using Windows ACL tools to remove write access for non-administrative users
• Implement Group Policy settings to enforce proper permissions on i-フィルター directories across managed systems
• Use application whitelisting solutions to prevent execution of unauthorized files even if placed in system directories
• Consider temporary isolation of affected systems from untrusted users until patches can be applied

# Windows PowerShell - Restrict directory permissions (example)
# Replace <i-Filter-Path> with actual installation directory
$path = "<i-Filter-Path>"
$acl = Get-Acl $path
$acl.SetAccessRuleProtection($true, $false)
$adminRule = New-Object System.Security.AccessControl.FileSystemAccessRule("Administrators","FullControl","ContainerInherit,ObjectInherit","None","Allow")
$systemRule = New-Object System.Security.AccessControl.FileSystemAccessRule("SYSTEM","FullControl","ContainerInherit,ObjectInherit","None","Allow")
$acl.AddAccessRule($adminRule)
$acl.AddAccessRule($systemRule)
Set-Acl $path $acl