Is CVE-2026-107895 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-107895 being exploited in the wild.

How severe is CVE-2026-107895?

High severity, with a CVSS score of 7.8, published 26 October 2026.

Which products and versions are affected?

Fuji Electric V-SFT 6.2.11.0 and prior.

Is there a fix for CVE-2026-107895?

Yes: fixed in V-SFT 6.2.12.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-107895 attacked?

It is attacked with local access.

Am I affected by CVE-2026-107895?

Check whether you run Fuji Electric V-SFT at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-107895: Fuji Electric V-SFT out-of-bounds write in V7 file parsing

CVE-2026-107895 · Severity: high · CVSS 7.8 · Published 2026-10-26

Fuji Electric V-SFT is engineering software used to configure and program industrial automation systems. An out-of-bounds write vulnerability in its V7 file parser allows an attacker to trigger information exposure or execute arbitrary code by sending a specially crafted file. A user opening a malicious V7 file with V-SFT could result in complete compromise of the engineering workstation.

Technologies: Fuji Electric V-SFT. Vendors: Fuji Electric.

Quick answers

Is CVE-2026-107895 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-107895 being exploited in the wild.
How severe is CVE-2026-107895?: High severity, with a CVSS score of 7.8, published 26 October 2026.
Which products and versions are affected?: Fuji Electric V-SFT 6.2.11.0 and prior.
Is there a fix for CVE-2026-107895?: Yes: fixed in V-SFT 6.2.12.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-107895 attacked?: It is attacked with local access.
Am I affected by CVE-2026-107895?: Check whether you run Fuji Electric V-SFT at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: V-SFT 6.2.12.0

Technical details

CVE-2026-107895 is an out-of-bounds write (CWE-787) in V-SFT's file parsing logic triggered when opening a crafted V7 file. The vulnerability requires local access and user interaction (opening a file), permitting an unauthenticated attacker to write beyond allocated buffer boundaries, potentially enabling arbitrary code execution. A patch is available in V-SFT 6.2.12.0.

Affected products

Fuji Electric V-SFT 6.2.11.0 and prior

Timeline

2026-10-26: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.