CVE-2026-56437 Overview
CVE-2026-56437 is an uncontrolled search path element vulnerability [CWE-427] affecting Fuji Electric Pupsman versions prior to 3.9.0. Pupsman is the Uninterruptible Power Supply (UPS) management software distributed by Fuji Electric. The installer resolves DLL dependencies from the directory containing the executable before searching secure system locations. Attackers who place a crafted Dynamic Link Library (DLL) in the same folder as the installer can execute arbitrary code with SYSTEM privilege when a user runs the installer. The issue requires local file placement and user interaction to trigger execution.
Critical Impact
Successful exploitation grants arbitrary code execution with SYSTEM privileges, providing full control over the affected Windows host.
Affected Products
- Fuji Electric Pupsman versions prior to 3.9.0
- Windows systems where the vulnerable installer is executed
- UPS-managed endpoints relying on Pupsman for power management
Discovery Timeline
- 2026-07-08 - CVE-2026-56437 published to NVD
- 2026-07-08 - Last updated in NVD database
Technical Details for CVE-2026-56437
Vulnerability Analysis
The vulnerability stems from insecure DLL search order behavior in the Pupsman installer. Windows resolves unqualified DLL references using a predictable search sequence. When an application does not specify a fully qualified path, the loader checks the directory of the executing binary first. The Pupsman installer references one or more DLLs without absolute paths and without applying safe search mode restrictions. An attacker who drops a malicious DLL matching the expected name into the installer directory achieves code execution when the installer loads that library.
Because installers typically run with elevated privileges through User Account Control (UAC), the injected DLL inherits SYSTEM-level rights. The result is a local privilege escalation and arbitrary code execution primitive gated only by the user running the installer.
Root Cause
The root cause is improper control of the DLL search path [CWE-427]. The installer fails to call SetDllDirectory, LoadLibraryEx with LOAD_LIBRARY_SEARCH_SYSTEM32, or otherwise restrict lookups to trusted directories. The current working directory or installer directory is treated as an acceptable source of code.
Attack Vector
Exploitation requires local access and user interaction. An attacker stages a malicious DLL in the same folder as the Pupsman installer, for example a downloads directory or a shared network folder. When a user or administrator launches the installer, the trojanized DLL loads with SYSTEM privileges. Common delivery vectors include phishing archives containing both the installer and the payload DLL, or supply-chain tampering of distribution mirrors.
No public proof-of-concept code is available at time of publication. Refer to the JVN #62347140 Vulnerability Report for vendor-coordinated technical details.
Detection Methods for CVE-2026-56437
Indicators of Compromise
- Unexpected DLL files residing alongside Pupsman installer executables in user-writable directories such as Downloads, Temp, or removable media
- Child processes spawned by the Pupsman installer that are not signed by Fuji Electric
- SYSTEM-level process creation events originating from installer directories outside Program Files
Detection Strategies
- Monitor Microsoft-Windows-Sysmon Event ID 7 (ImageLoad) for DLLs loaded by the Pupsman installer from non-standard paths
- Alert on process creation events where the parent is the Pupsman installer and the child executes from a user-writable directory
- Hunt for file-write events that place .dll files into the same directory as a known installer binary within a short time window
Monitoring Recommendations
- Baseline expected DLL load paths for legitimate installer runs and alert on deviations
- Correlate installer execution telemetry with recent downloads or archive extractions to catch staged payloads
- Track SYSTEM-level process launches originating from %USERPROFILE% subdirectories, which should be rare on production endpoints
How to Mitigate CVE-2026-56437
Immediate Actions Required
- Upgrade Pupsman to version 3.9.0 or later on all managed Windows hosts
- Remove older Pupsman installers from shared folders, file servers, and user download directories
- Restrict installer execution to administrators using application control policies such as Windows Defender Application Control (WDAC) or AppLocker
Patch Information
Fuji Electric addresses the issue in Pupsman 3.9.0. Obtain the fixed release from the Fuji Electric UPS Management Software product page and validate the digital signature before deployment. Coordination details are published in the JVN #62347140 Vulnerability Report.
Workarounds
- Execute the installer only from a clean, dedicated directory that contains no other files
- Verify no unsigned DLL files exist in the installer directory prior to launch
- Set the CWDIllegalInDllSearch registry value to block DLL loads from the current working directory as a defense-in-depth control
# Configuration example: enforce safe DLL search on Windows endpoints
reg add "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager" /v CWDIllegalInDllSearch /t REG_DWORD /d 0xFFFFFFFF /f
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
