CVE-2026-26050

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-26050", "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce", "state": "PUBLISHED", "assignerShortName": "jpcert", "dateReserved": "2026-02-17T06:44:17.959Z", "datePublished": "2026-02-20T08:13:31.884Z", "dateUpdated": "2026-02-20T13:45:42.678Z"}, "containers": {"cna": {"affected": [{"vendor": "Ricoh Company, Ltd.", "product": "\u30b8\u30e7\u30d6\u30ed\u30b0\u96c6\u8a08/\u5206\u6790\u30bd\u30d5\u30c8\u30a6\u30a7\u30a2 RICOH\u30b8\u30e7\u30d6\u30ed\u30b0\u96c6\u8a08\u30c4\u30fc\u30eb", "versions": [{"version": "versions prior to Ver.1.3.7", "status": "affected"}]}], "descriptions": [{"lang": "en", "value": "The installer for \u30b8\u30e7\u30d6\u30ed\u30b0\u96c6\u8a08/\u5206\u6790\u30bd\u30d5\u30c8\u30a6\u30a7\u30a2 RICOH\u30b8\u30e7\u30d6\u30ed\u30b0\u96c6\u8a08\u30c4\u30fc\u30eb versions prior to Ver.1.3.7 contains an issue with the DLL search path, which may lead to insecurely loading Dynamic Link Libraries. As a result, arbitrary code may be executed with administrative privileges."}], "problemTypes": [{"descriptions": [{"description": "Uncontrolled Search Path Element", "lang": "en-US", "cweId": "CWE-427", "type": "CWE"}]}], "references": [{"url": "https://support.ricoh.com/bbv2/html/dr_ut_d/ut/history/w/bb/pub_j/dr_ut_d/4101031/4101031555/V137/5260588/260588/history.htm"}, {"url": "https://jvn.jp/en/jp/JVN69531868/"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en-US", "value": "GENERAL"}], "cvssV3_0": {"version": "3.0", "baseSeverity": "HIGH", "baseScore": 7.8, "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"}}, {"format": "CVSS", "scenarios": [{"lang": "en-US", "value": "GENERAL"}], "cvssV4_0": {"version": "4.0", "baseSeverity": "HIGH", "baseScore": 8.4, "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"}}], "providerMetadata": {"orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce", "shortName": "jpcert", "dateUpdated": "2026-02-20T08:13:31.884Z"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-20T13:45:28.617862Z", "id": "CVE-2026-26050", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-20T13:45:42.678Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-26050", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-02-20T13:45:28.617862Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-20T13:45:35.588Z"}}], "cna": {"metrics": [{"format": "CVSS", "cvssV3_0": {"version": "3.0", "baseScore": 7.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"}, "scenarios": [{"lang": "en-US", "value": "GENERAL"}]}, {"format": "CVSS", "cvssV4_0": {"version": "4.0", "baseScore": 8.4, "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"}, "scenarios": [{"lang": "en-US", "value": "GENERAL"}]}], "affected": [{"vendor": "Ricoh Company, Ltd.", "product": "\u30b8\u30e7\u30d6\u30ed\u30b0\u96c6\u8a08/\u5206\u6790\u30bd\u30d5\u30c8\u30a6\u30a7\u30a2 RICOH\u30b8\u30e7\u30d6\u30ed\u30b0\u96c6\u8a08\u30c4\u30fc\u30eb", "versions": [{"status": "affected", "version": "versions prior to Ver.1.3.7"}]}], "references": [{"url": "https://support.ricoh.com/bbv2/html/dr_ut_d/ut/history/w/bb/pub_j/dr_ut_d/4101031/4101031555/V137/5260588/260588/history.htm"}, {"url": "https://jvn.jp/en/jp/JVN69531868/"}], "descriptions": [{"lang": "en", "value": "The installer for \u30b8\u30e7\u30d6\u30ed\u30b0\u96c6\u8a08/\u5206\u6790\u30bd\u30d5\u30c8\u30a6\u30a7\u30a2 RICOH\u30b8\u30e7\u30d6\u30ed\u30b0\u96c6\u8a08\u30c4\u30fc\u30eb versions prior to Ver.1.3.7 contains an issue with the DLL search path, which may lead to insecurely loading Dynamic Link Libraries. As a result, arbitrary code may be executed with administrative privileges."}], "problemTypes": [{"descriptions": [{"lang": "en-US", "type": "CWE", "cweId": "CWE-427", "description": "Uncontrolled Search Path Element"}]}], "providerMetadata": {"orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce", "shortName": "jpcert", "dateUpdated": "2026-02-20T08:13:31.884Z"}}}, "cveMetadata": {"cveId": "CVE-2026-26050", "state": "PUBLISHED", "dateUpdated": "2026-02-20T13:45:42.678Z", "dateReserved": "2026-02-17T06:44:17.959Z", "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce", "datePublished": "2026-02-20T08:13:31.884Z", "assignerShortName": "jpcert"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "\u30b8\u30e7\u30d6\u30ed\u30b0\u96c6\u8a08/\u5206\u6790\u30bd\u30d5\u30c8\u30a6\u30a7\u30a2 RICOH\u30b8\u30e7\u30d6\u30ed\u30b0\u96c6\u8a08\u30c4\u30fc\u30eb", "vendor": "Ricoh Company, Ltd.", "versions": [{"status": "affected", "version": "versions prior to Ver.1.3.7"}]}], "source": "vultures@jpcert.or.jp"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The installer for \u30b8\u30e7\u30d6\u30ed\u30b0\u96c6\u8a08/\u5206\u6790\u30bd\u30d5\u30c8\u30a6\u30a7\u30a2 RICOH\u30b8\u30e7\u30d6\u30ed\u30b0\u96c6\u8a08\u30c4\u30fc\u30eb versions prior to Ver.1.3.7 contains an issue with the DLL search path, which may lead to insecurely loading Dynamic Link Libraries. As a result, arbitrary code may be executed with administrative privileges."}, {"lang": "es", "value": "El instalador para ???????/???????? RICOH?????????? versiones anteriores a la Ver.1.3.7 contiene un problema con la ruta de b\u00fasqueda de DLL, lo que puede llevar a la carga insegura de Bibliotecas de Enlace Din\u00e1mico. Como resultado, se puede ejecutar c\u00f3digo arbitrario con privilegios administrativos."}], "id": "CVE-2026-26050", "lastModified": "2026-06-17T10:25:38.970", "metrics": {"cvssMetricV30": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.0"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "vultures@jpcert.or.jp", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "LOCAL", "availabilityRequirement": "NOT_DEFINED", "baseScore": 8.4, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "ACTIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "vultures@jpcert.or.jp", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-26050", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-02-20T13:45:28.617862Z", "version": "2.0.3"}}]}, "published": "2026-02-20T09:15:54.617", "references": [{"source": "vultures@jpcert.or.jp", "url": "https://jvn.jp/en/jp/JVN69531868/"}, {"source": "vultures@jpcert.or.jp", "url": "https://support.ricoh.com/bbv2/html/dr_ut_d/ut/history/w/bb/pub_j/dr_ut_d/4101031/4101031555/V137/5260588/260588/history.htm"}], "sourceIdentifier": "vultures@jpcert.or.jp", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-427"}], "source": "vultures@jpcert.or.jp", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,1.3.7)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "manual", "scores": [{"score": 100.0, "source": "manual"}]}, "original": {"product": "\u30b8\u30e7\u30d6\u30ed\u30b0\u96c6\u8a08/\u5206\u6790\u30bd\u30d5\u30c8\u30a6\u30a7\u30a2 RICOH\u30b8\u30e7\u30d6\u30ed\u30b0\u96c6\u8a08\u30c4\u30fc\u30eb", "source": "cna", "vendor": "Ricoh Company, Ltd."}, "product": "jobblogging_aggregation_tool", "vendor": "ricoh"}], "analysis": {"en": {"generated_at": "2026-04-17T17:29:21.361220+00:00", "value": {"mitigation_remediation": ["Upgrade the RICOH Journal Aggregation Tool to version 1.3.7 or newer to eliminate the insecure DLL search path flaw.", "Ensure that installers are obtained only from trusted sources and avoid running them from compromised or unverified locations.", "Configure the system to enforce strict DLL search path policies (e.g., restrict to system directories) and monitor for unauthorized DLL loading during installation."], "summary": {"action": "Immediate Patch", "impact": "Arbitrary code execution with administrative privileges via insecure DLL loading"}, "threat_synthesis": {"affected_systems": "Manufactured by Ricoh Company, Ltd., the vulnerability affects the \"\u30b8\u30e7\u30d6\u30ed\u30b0\u96c6\u8a08/\u5206\u6790\u30bd\u30d5\u30c8\u30a6\u30a7\u30a2 RICOH\u30b8\u30e7\u30d6\u30ed\u30b0\u96c6\u8a08\u30c4\u30fc\u30eb\" installer in all releases before version 1.3.7. Upgrading to 1.3.7 or later removes the issue.", "description_and_impact": "An insecure DLL search path in the installer of the RICOH Journal Aggregation Tool allows an attacker to cause the system to load a malicious DLL. This flaw can lead to execution of arbitrary code with full administrative rights on the affected machine. The weakness is a classic DLL search path traversal (CWE-427).", "risk_and_exploitability": "The CVSS score of 8.4 indicates high severity. The EPSS score of <1% suggests a low likelihood of exploit at present, and the vulnerability is not currently listed in the CISA KEV catalog. The most likely attack vector is a local installation scenario where an attacker can run the installer with elevated privileges, causing the vulnerable DLL search to load a crafted library. If successful, the attacker gains full control of the system."}}}}, "created": "2026-02-23T14:47:08.241742+00:00", "title": "DLL Search Path Manipulation in RICOH Journal Tool Enables Admin Code Execution", "updated": "2026-04-17T17:30:23.869271+00:00", "vendors": ["ricoh", "ricoh$PRODUCT$jobblogging_aggregation_tool"]}