CVE-2026-5397: UPS Management DLL Hijacking Vulnerability

CVE-2026-5397 Overview

A DLL hijacking vulnerability (CWE-427) has been identified in an Omron UPS (Uninterruptible Power Supply) management application. The vulnerability exists due to improper permissions on the installation directory, which allows a malicious actor to place a DLL that is then executed with administrator privileges during service startup.

If a malicious DLL is placed in the installation directory of this product, there is a possibility that the malicious DLL may be executed by exploiting the product's behavior of loading missing DLLs from the same directory as the executable during service startup.

Critical Impact

A local attacker with low privileges can achieve privilege escalation to administrator by exploiting the DLL search order hijacking vulnerability, potentially leading to full system compromise with high impact to confidentiality, integrity, and availability.

Affected Products

• Omron UPS Management Application (specific versions not disclosed in CVE data)

Discovery Timeline

• April 15, 2026 - CVE-2026-5397 published to NVD
• April 15, 2026 - Last updated in NVD database

Technical Details for CVE-2026-5397

Vulnerability Analysis

This vulnerability is classified as CWE-427 (Uncontrolled Search Path Element), commonly known as DLL hijacking or DLL search order hijacking. The root issue stems from the UPS management application's behavior during service startup, where it attempts to load DLLs from its installation directory before searching more secure system directories.

The vulnerability requires local access to the target system and elevated privileges are achieved through the Windows service execution context. When the UPS management service starts, it loads DLLs from its installation directory, and due to weak directory permissions, an attacker can place a malicious DLL in this location. The service then loads and executes this malicious DLL with administrator privileges, effectively escalating the attacker's privileges.

The changed scope in the attack scenario indicates that exploitation can affect resources beyond the vulnerable component's security scope, potentially impacting the entire system.

Root Cause

The vulnerability originates from two compounding security weaknesses:

1. Improper Directory Permissions: The installation directory lacks appropriate access controls, allowing users with lower privileges to write files to the directory.

2. Insecure DLL Loading Behavior: The application loads missing DLLs from the same directory as the executable rather than using a secure DLL search order or specifying absolute paths.

This combination creates a classic DLL hijacking scenario where attackers can plant malicious code that will be executed in a privileged context.

Attack Vector

The attack requires local access to the system. An attacker must:

1. Identify DLLs that the UPS management service attempts to load but cannot find in secure system directories
2. Craft a malicious DLL with the same name as the missing DLL
3. Place the malicious DLL in the application's installation directory (possible due to weak permissions)
4. Wait for or trigger a service restart, at which point the malicious DLL is loaded and executed with administrator privileges

The vulnerability mechanism involves the Windows DLL search order. When an application loads a DLL without specifying a full path, Windows searches through a predefined sequence of directories. By placing a malicious DLL earlier in this search path (in the application directory), attackers can hijack the loading process. For technical details, see the Omron Security Advisory.

Detection Methods for CVE-2026-5397

Indicators of Compromise

• Unexpected DLL files appearing in the UPS management application installation directory
• New or modified DLL files with recent timestamps that don't match vendor-provided files
• Service startup events correlated with unusual process spawning or network activity
• Unsigned or invalidly signed DLLs in the application directory

Detection Strategies

• Monitor file system changes to the UPS management application installation directory using file integrity monitoring (FIM) tools
• Implement application whitelisting to prevent unauthorized DLLs from executing
• Deploy endpoint detection and response (EDR) solutions to detect DLL hijacking patterns and privilege escalation attempts
• Review Windows Event Logs for service startup failures or unusual DLL loading events

Monitoring Recommendations

• Configure SentinelOne to alert on DLL loads from non-standard or writable directories by privileged services
• Establish baseline DLL inventories for the UPS management application and alert on deviations
• Monitor for suspicious process creation chains where the UPS service spawns unexpected child processes
• Track permission changes to the application installation directory

How to Mitigate CVE-2026-5397

Immediate Actions Required

• Review and restrict permissions on the UPS management application installation directory to prevent unauthorized writes
• Audit the installation directory for any unauthorized or suspicious DLL files
• Apply vendor patches as soon as they become available from Omron
• Consider temporarily disabling the UPS management service if it is not critical to operations until patches can be applied

Patch Information

Omron has released a security advisory addressing this vulnerability. Administrators should consult the Omron Security Advisory (English) or the Omron Security Advisory (Japanese) for official patch and remediation guidance.

Workarounds

• Restrict write access to the application installation directory using Windows ACLs, allowing only administrators and SYSTEM to write files
• Implement application control policies to block execution of unsigned or untrusted DLLs
• Use process monitoring tools to detect and block DLL side-loading attempts
• Deploy SentinelOne Singularity to provide behavioral protection against DLL hijacking and privilege escalation attacks

# Restrict installation directory permissions (PowerShell)
# Replace <InstallPath> with actual UPS application installation path
icacls "<InstallPath>" /inheritance:r
icacls "<InstallPath>" /grant:r "SYSTEM:(OI)(CI)F"
icacls "<InstallPath>" /grant:r "Administrators:(OI)(CI)F"
icacls "<InstallPath>" /grant:r "Users:(OI)(CI)RX"