Is CVE-2026-97860 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-97860 being exploited in the wild.

How severe is CVE-2026-97860?

Medium severity, with a CVSS score of 6.7, published 29 October 2026.

Which products and versions are affected?

Yamaha YMS-VPN8 Ver. 1.04.00 and earlier; Yamaha YMS-VPN8-CP Ver. 1.04.00 and earlier.

How is CVE-2026-97860 attacked?

It is attacked with local access, in a software library.

Am I affected by CVE-2026-97860?

Check whether you run Yamaha YMS-VPN8 or Yamaha YMS-VPN8-CP at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-97860: Yamaha YMS-VPN8 unquoted service file path privilege escalation

CVE-2026-97860 · Severity: medium · CVSS 6.7 · Published 2026-10-29

YMS-VPN8 and YMS-VPN8-CP are VPN client applications for Windows that register system services with unquoted file paths. An attacker with local system access can exploit this to execute arbitrary code with SYSTEM-level privileges, potentially compromising files, credentials, and system stability. This requires the attacker to already be logged in to the computer.

Vendors: Yamaha.

Quick answers

Is CVE-2026-97860 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-97860 being exploited in the wild.
How severe is CVE-2026-97860?: Medium severity, with a CVSS score of 6.7, published 29 October 2026.
Which products and versions are affected?: Yamaha YMS-VPN8 Ver. 1.04.00 and earlier; Yamaha YMS-VPN8-CP Ver. 1.04.00 and earlier.
Is there a fix for CVE-2026-97860?: Yes: fixed in YMS-VPN8 Ver. 1.07.00, YMS-VPN8-CP Ver. 1.07.00. Until then: Do not share the Windows PC with other users; do not allow untrusted users to log in; do not grant administrative privileges to users who do not require them; do not execute files or programs from unknown or untrusted sources. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-97860 attacked?: It is attacked with local access, in a software library.
Am I affected by CVE-2026-97860?: Check whether you run Yamaha YMS-VPN8 or Yamaha YMS-VPN8-CP at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: YMS-VPN8 Ver. 1.07.00, YMS-VPN8-CP Ver. 1.07.00

Do not share the Windows PC with other users; do not allow untrusted users to log in; do not grant administrative privileges to users who do not require them; do not execute files or programs from unknown or untrusted sources.

Technical details

The vulnerability stems from unquoted search path elements (CWE-428) in the Windows service registration of YMS-VPN8 and YMS-VPN8-CP. An authenticated local user with write permissions on the system drive can place a malicious executable in a path that the service searches, gaining SYSTEM-level code execution when the service starts. This is a local privilege escalation with no network attack vector.

Affected products

Yamaha YMS-VPN8 Ver. 1.04.00 and earlier
Yamaha YMS-VPN8-CP Ver. 1.04.00 and earlier

Timeline

2026-10-28: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.