CVE-2026-32680

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-32680", "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce", "state": "PUBLISHED", "assignerShortName": "jpcert", "dateReserved": "2026-03-19T02:37:43.433Z", "datePublished": "2026-03-26T06:55:18.684Z", "dateUpdated": "2026-03-26T14:13:14.348Z"}, "containers": {"cna": {"affected": [{"vendor": "RATOC Systems, Inc.", "product": "RATOC RAID Monitoring Manager for Windows", "versions": [{"version": "prior to 2.00.009.260220", "status": "affected"}]}], "descriptions": [{"lang": "en", "value": "The installer of RATOC RAID Monitoring Manager for Windows allows to customize the installation folder. If the installation folder is customized to some non-default one, the folder may be left with un-secure ACLs and non-administrative users can alter contents of that folder. It may allow a non-administrative user to execute an arbitrary code with SYSTEM privilege."}], "problemTypes": [{"descriptions": [{"description": "Incorrect default permissions", "lang": "en-US", "cweId": "CWE-276", "type": "CWE"}]}], "references": [{"url": "https://www.ratocsystems.com/topics/userinfo/raidmanager202508/"}, {"url": "https://jvn.jp/en/jp/JVN08057419/"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en-US", "value": "GENERAL"}], "cvssV3_0": {"version": "3.0", "baseSeverity": "HIGH", "baseScore": 7.8, "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}}, {"format": "CVSS", "scenarios": [{"lang": "en-US", "value": "GENERAL"}], "cvssV4_0": {"version": "4.0", "baseSeverity": "HIGH", "baseScore": 8.5, "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"}}], "providerMetadata": {"orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce", "shortName": "jpcert", "dateUpdated": "2026-03-26T06:55:18.684Z"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-26T14:12:26.563846Z", "id": "CVE-2026-32680", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-26T14:13:14.348Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-32680", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-03-26T14:12:26.563846Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-26T14:13:02.795Z"}}], "cna": {"metrics": [{"format": "CVSS", "cvssV3_0": {"version": "3.0", "baseScore": 7.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}, "scenarios": [{"lang": "en-US", "value": "GENERAL"}]}, {"format": "CVSS", "cvssV4_0": {"version": "4.0", "baseScore": 8.5, "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"}, "scenarios": [{"lang": "en-US", "value": "GENERAL"}]}], "affected": [{"vendor": "RATOC Systems, Inc.", "product": "RATOC RAID Monitoring Manager for Windows", "versions": [{"status": "affected", "version": "prior to 2.00.009.260220"}]}], "references": [{"url": "https://www.ratocsystems.com/topics/userinfo/raidmanager202508/"}, {"url": "https://jvn.jp/en/jp/JVN08057419/"}], "descriptions": [{"lang": "en", "value": "The installer of RATOC RAID Monitoring Manager for Windows allows to customize the installation folder. If the installation folder is customized to some non-default one, the folder may be left with un-secure ACLs and non-administrative users can alter contents of that folder. It may allow a non-administrative user to execute an arbitrary code with SYSTEM privilege."}], "problemTypes": [{"descriptions": [{"lang": "en-US", "type": "CWE", "cweId": "CWE-276", "description": "Incorrect default permissions"}]}], "providerMetadata": {"orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce", "shortName": "jpcert", "dateUpdated": "2026-03-26T06:55:18.684Z"}}}, "cveMetadata": {"cveId": "CVE-2026-32680", "state": "PUBLISHED", "dateUpdated": "2026-03-26T14:13:14.348Z", "dateReserved": "2026-03-19T02:37:43.433Z", "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce", "datePublished": "2026-03-26T06:55:18.684Z", "assignerShortName": "jpcert"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "RATOC RAID Monitoring Manager for Windows", "vendor": "RATOC Systems, Inc.", "versions": [{"status": "affected", "version": "prior to 2.00.009.260220"}]}], "source": "vultures@jpcert.or.jp"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The installer of RATOC RAID Monitoring Manager for Windows allows to customize the installation folder. If the installation folder is customized to some non-default one, the folder may be left with un-secure ACLs and non-administrative users can alter contents of that folder. It may allow a non-administrative user to execute an arbitrary code with SYSTEM privilege."}, {"lang": "es", "value": "El instalador de RATOC RAID Monitoring Manager para Windows permite personalizar la carpeta de instalaci\u00f3n. Si la carpeta de instalaci\u00f3n se personaliza a una no predeterminada, la carpeta puede quedar con ACLs inseguras y los usuarios no administrativos pueden alterar el contenido de esa carpeta. Esto puede permitir a un usuario no administrativo ejecutar c\u00f3digo arbitrario con privilegios de SYSTEM."}], "id": "CVE-2026-32680", "lastModified": "2026-06-17T10:36:11.690", "metrics": {"cvssMetricV30": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.0"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "vultures@jpcert.or.jp", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "LOCAL", "availabilityRequirement": "NOT_DEFINED", "baseScore": 8.5, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "vultures@jpcert.or.jp", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-32680", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-03-26T14:12:26.563846Z", "version": "2.0.3"}}]}, "published": "2026-03-26T07:16:20.220", "references": [{"source": "vultures@jpcert.or.jp", "url": "https://jvn.jp/en/jp/JVN08057419/"}, {"source": "vultures@jpcert.or.jp", "url": "https://www.ratocsystems.com/topics/userinfo/raidmanager202508/"}], "sourceIdentifier": "vultures@jpcert.or.jp", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-276"}], "source": "vultures@jpcert.or.jp", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": ["windows"], "status": "affected", "versions": {"scheme": "generic", "value": "[0,2.00.009.260220)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "manual", "scores": [{"score": 100.0, "source": "manual"}]}, "original": {"product": "RATOC RAID Monitoring Manager for Windows", "source": "cna", "vendor": "RATOC Systems, Inc."}, "product": "raid_monitoring_manager", "vendor": "ratocsystems"}], "analysis": {"en": {"generated_at": "2026-03-26T08:50:42.191961+00:00", "value": {"mitigation_remediation": ["Apply the latest vendor\u2011supplied patch or upgrade to a version that enforces proper ACLs on the installation folder.", "Verify that the installation directory\u2019s ACLs restrict modify permissions to administrators only."], "summary": {"action": "Immediate Patch", "impact": "Privilege Escalation"}, "threat_synthesis": {"affected_systems": "The vulnerability affects RATOC RAID Monitoring Manager for Windows from RATOC Systems, Inc. The CVE advisory does not specify affected versions, so any installation that permits custom folder selection could be impacted.", "description_and_impact": "The installer of RATOC RAID Monitoring Manager for Windows permits users to select a custom installation directory. When a non\u2011default folder is chosen, the installer can leave the folder's access\u2011control lists insecure, allowing non\u2011administrative users to modify its contents. By replacing or editing these files, an attacker can execute arbitrary code that runs with SYSTEM privileges, granting full control over the system.", "risk_and_exploitability": "The CVSS score of 8.5 indicates a high severity vulnerability. EPSS data is not available and the flaw is not listed in CISA's KEV catalog. The likely attack vector is local: a non\u2011administrative user who can install or modify the application. Exploitation requires manipulating the insecure ACLs of the installation directory; once the attacker gains write access to the directory, they can replace executable files or inject malicious code, thereby executing it with SYSTEM privilege and compromising confidentiality, integrity, and availability."}}}}, "created": "2026-03-26T11:30:12.652055+00:00", "title": "Privilege Escalation via Unsecured Installation Folder in RATOC RAID Monitoring Manager for Windows", "updated": "2026-03-26T12:08:18.304526+00:00", "vendors": ["ratocsystems", "ratocsystems$PRODUCT$raid_monitoring_manager"]}