CVE-2026-57895: Pupsman RCE Vulnerability via Permissions

CVE-2026-57895 Overview

CVE-2026-57895 is an incorrect default permissions vulnerability [CWE-276] in Fuji Electric Pupsman UPS management software versions prior to 3.9.0. The installation directory receives permissions that allow low-privileged local users to write files into it. An attacker who plants a malicious executable in that folder achieves arbitrary code execution with SYSTEM privileges when the software or a related service runs the binary. The flaw is local in scope but delivers full privilege escalation on affected Windows hosts.

Critical Impact
A local, low-privileged attacker can escalate to SYSTEM by dropping a malicious executable into the Pupsman installation directory.

Affected Products

Fuji Electric Pupsman UPS management software versions prior to 3.9.0
Windows hosts running vulnerable Pupsman installations
Systems where Pupsman services execute with SYSTEM privileges

Discovery Timeline

2026-07-08 - CVE-2026-57895 published to NVD
2026-07-08 - Last updated in NVD database

Technical Details for CVE-2026-57895

Vulnerability Analysis

Pupsman installs its program files into a directory whose Access Control List (ACL) grants write access to non-administrative users. Because a Pupsman service or scheduled task launches executables from that directory under the SYSTEM account, any file an attacker places there inherits that elevated execution context. The result is a classic insecure permissions to privilege escalation chain [CWE-276].

The vulnerability requires local access and low privileges, with no user interaction. Exploitation does not depend on memory corruption, race conditions, or complex triggers. Standard file-write primitives available to any interactive user are sufficient.

Root Cause

The root cause is the installer setting overly permissive default Discretionary Access Control List (DACL) entries on the installation folder. Groups such as Authenticated Users or Users receive write or modify rights on a directory that hosts binaries executed by a privileged service. Windows enforces the ACL as configured, so the operating system faithfully executes attacker-supplied content.

Attack Vector

An attacker with an existing local account performs three steps. First, the attacker enumerates the Pupsman installation directory and confirms writable permissions using tools such as icacls or AccessChk. Second, the attacker drops a malicious executable or Dynamic Link Library (DLL) with a name Pupsman loads at startup, on a schedule, or through DLL search order. Third, the attacker waits for the service to invoke the file, or triggers a restart, and the payload runs as SYSTEM.

No verified public exploit is currently indexed for this CVE. Refer to the JVN #62347140 Advisory for coordinated disclosure details and to the Fuji Electric UPS Management Software page for product information.

Detection Methods for CVE-2026-57895

Indicators of Compromise

Unexpected executable, DLL, or script files appearing in the Pupsman installation directory
New or modified binaries in the Pupsman folder with recent timestamps that do not match the installer manifest
Child processes spawned by Pupsman services running under NT AUTHORITY\SYSTEM that are not signed by Fuji Electric
Outbound network connections originating from processes located in the Pupsman installation path

Detection Strategies

Audit ACLs on the Pupsman installation directory using icacls and flag hosts where non-admin principals hold write, modify, or full control rights
Monitor file creation and modification events in the installation folder using Windows Event ID 4663 with a System Access Control List (SACL) applied
Correlate process creation events (Event ID 4688 or Sysmon Event ID 1) where the parent is a Pupsman service and the child image is unsigned or unexpected

Monitoring Recommendations

Enable object access auditing on the Pupsman directory and forward events to a centralized log platform
Baseline the set of executables and libraries in the installation folder and alert on deviations
Track service restarts and scheduled task executions tied to Pupsman for anomalous invocation patterns

How to Mitigate CVE-2026-57895

Immediate Actions Required

Upgrade Pupsman to version 3.9.0 or later on all affected Windows hosts
Inventory endpoints running Pupsman and prioritize multi-user or shared-workstation deployments
Restrict interactive logon rights on servers hosting Pupsman to reduce the local attacker population

Patch Information

Fuji Electric addresses the issue in Pupsman 3.9.0. Download the fixed release from the vendor and follow the guidance in the JVN #62347140 Advisory. Verify the installation directory permissions after upgrade, as some installers preserve prior ACLs.

Workarounds

Manually harden the Pupsman installation directory ACL to remove write and modify rights from Users and Authenticated Users, retaining access only for Administrators and SYSTEM
Apply application allowlisting through Windows Defender Application Control (WDAC) or AppLocker to block unsigned binaries from executing out of the Pupsman directory
Limit local logon on systems running Pupsman to trusted administrative accounts until patching is complete

bash

# Configuration example: restrict ACLs on the Pupsman installation directory
icacls "C:\Program Files\Pupsman" /inheritance:r
icacls "C:\Program Files\Pupsman" /grant:r "Administrators:(OI)(CI)F"
icacls "C:\Program Files\Pupsman" /grant:r "SYSTEM:(OI)(CI)F"
icacls "C:\Program Files\Pupsman" /grant:r "Users:(OI)(CI)RX"