# CVE-2026-97860: Yamaha YMS-VPN8 unquoted service file path privilege escalation

Source: https://junglewise.ai/threats/cve-2026-97860-yms-vpn8-and-yms-vpn8-cp-provided-by-yamaha-corporation-register  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-29. Updated: 2026-10-29  
License: CC BY 4.0 with a link back

CVE-2026-97860 · Severity: medium · CVSS 6.7 · Published 2026-10-29

YMS-VPN8 and YMS-VPN8-CP are VPN client applications for Windows that register system services with unquoted file paths. An attacker with local system access can exploit this to execute arbitrary code with SYSTEM-level privileges, potentially compromising files, credentials, and system stability. This requires the attacker to already be logged in to the computer.

Vendors: [Yamaha](https://junglewise.ai/threats/vendors/yamaha).

## Quick answers

**Is CVE-2026-97860 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-97860 being exploited in the wild.

**How severe is CVE-2026-97860?** Medium severity, with a CVSS score of 6.7, published 29 October 2026.

**Which products and versions are affected?** Yamaha YMS-VPN8 Ver. 1.04.00 and earlier; Yamaha YMS-VPN8-CP Ver. 1.04.00 and earlier.

**Is there a fix for CVE-2026-97860?** Yes: fixed in YMS-VPN8 Ver. 1.07.00, YMS-VPN8-CP Ver. 1.07.00. Until then: Do not share the Windows PC with other users; do not allow untrusted users to log in; do not grant administrative privileges to users who do not require them; do not execute files or programs from unknown or untrusted sources. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-97860 attacked?** It is attacked with local access, in a software library.

**Am I affected by CVE-2026-97860?** Check whether you run Yamaha YMS-VPN8 or Yamaha YMS-VPN8-CP at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in YMS-VPN8 Ver. 1.07.00, YMS-VPN8-CP Ver. 1.07.00

Do not share the Windows PC with other users; do not allow untrusted users to log in; do not grant administrative privileges to users who do not require them; do not execute files or programs from unknown or untrusted sources.

## Technical details

The vulnerability stems from unquoted search path elements (CWE-428) in the Windows service registration of YMS-VPN8 and YMS-VPN8-CP. An authenticated local user with write permissions on the system drive can place a malicious executable in a path that the service searches, gaining SYSTEM-level code execution when the service starts. This is a local privilege escalation with no network attack vector.

## Affected products

- Yamaha YMS-VPN8 Ver. 1.04.00 and earlier
- Yamaha YMS-VPN8-CP Ver. 1.04.00 and earlier

## Timeline

- 2026-10-28: disclosed

## References

- [https://jvn.jp/en/jp/JVN30675482/](https://jvn.jp/en/jp/JVN30675482/)
- [https://www.rtpro.yamaha.co.jp/RT/FAQ/Security/JVN30675482.html](https://www.rtpro.yamaha.co.jp/RT/FAQ/Security/JVN30675482.html)