CVE-2026-5397

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-5397", "assignerOrgId": "bba440f9-ef23-4224-aa62-7ac0935d18d1", "state": "PUBLISHED", "assignerShortName": "OMRON", "dateReserved": "2026-04-02T00:17:38.524Z", "datePublished": "2026-04-15T04:11:29.716Z", "dateUpdated": "2026-04-15T16:13:26.313Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "bba440f9-ef23-4224-aa62-7ac0935d18d1", "shortName": "OMRON", "dateUpdated": "2026-04-15T04:11:29.716Z"}, "title": "Vulnerability Related to an Uncontrolled Search Path Element in a UPS Management Application", "datePublic": "2026-04-15T04:08:00.000Z", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-427", "description": "CWE-427 Uncontrolled Search Path Element", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-471", "descriptions": [{"lang": "en", "value": "CAPEC-471 Search Order Hijacking"}]}], "affected": [{"vendor": "OMRON SOCIAL SOLUTIONS CO., Ltd.", "product": "PowerAttendant Standard Edition", "platforms": ["Windows"], "versions": [{"status": "affected", "version": "2.1.2 or lower", "versionType": "custom"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "It has been identified that a vulnerability (CWE-427) exists in the UPS (Uninterruptible Power Supply) management application, whereby improper permissions on the installation directory allow a malicious actor to place a DLL that\u00a0is then executed with administrator privileges.\n\nIf a malicious DLL is placed in the installation directory of this product, there is a possibility that the malicious DLL\u00a0may be executed by exploiting the product\u2019s behavior of loading missing DLLs from the same directory as the executable during service startup.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<div>It has been identified that a vulnerability (CWE-427) exists in the UPS (Uninterruptible Power Supply) management application, whereby improper permissions on the installation directory allow a malicious actor to place a DLL that&nbsp;is then executed with administrator privileges.</div>If a malicious DLL is placed in the installation directory of this product, there is a possibility that the malicious DLL&nbsp;may be executed by exploiting the product\u2019s behavior of loading missing DLLs from the same directory as the executable during service startup."}]}], "references": [{"url": "https://www.omron.com/jp/ja/inquiry/data/OMSR-2026-001_ja.pdf"}, {"url": "https://www.omron.com/global/en/inquiry/data/OMSR-2026-001_en.pdf"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "LOCAL", "attackComplexity": "HIGH", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "CHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH", "baseSeverity": "HIGH", "baseScore": 7.8, "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H"}}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 1.0.1"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-15T13:46:38.260570Z", "id": "CVE-2026-5397", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-15T16:13:26.313Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-5397", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-04-15T13:46:38.260570Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-15T13:46:44.852Z"}}], "cna": {"title": "Vulnerability Related to an Uncontrolled Search Path Element in a UPS Management Application", "source": {"discovery": "UNKNOWN"}, "impacts": [{"capecId": "CAPEC-471", "descriptions": [{"lang": "en", "value": "CAPEC-471 Search Order Hijacking"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "OMRON SOCIAL SOLUTIONS CO., Ltd.", "product": "PowerAttendant Standard Edition", "versions": [{"status": "affected", "version": "2.1.2 or lower", "versionType": "custom"}], "platforms": ["Windows"], "defaultStatus": "unaffected"}], "datePublic": "2026-04-15T04:08:00.000Z", "references": [{"url": "https://www.omron.com/jp/ja/inquiry/data/OMSR-2026-001_ja.pdf"}, {"url": "https://www.omron.com/global/en/inquiry/data/OMSR-2026-001_en.pdf"}], "x_generator": {"engine": "Vulnogram 1.0.1"}, "descriptions": [{"lang": "en", "value": "It has been identified that a vulnerability (CWE-427) exists in the UPS (Uninterruptible Power Supply) management application, whereby improper permissions on the installation directory allow a malicious actor to place a DLL that\u00a0is then executed with administrator privileges.\n\nIf a malicious DLL is placed in the installation directory of this product, there is a possibility that the malicious DLL\u00a0may be executed by exploiting the product\u2019s behavior of loading missing DLLs from the same directory as the executable during service startup.", "supportingMedia": [{"type": "text/html", "value": "<div>It has been identified that a vulnerability (CWE-427) exists in the UPS (Uninterruptible Power Supply) management application, whereby improper permissions on the installation directory allow a malicious actor to place a DLL that&nbsp;is then executed with administrator privileges.</div>If a malicious DLL is placed in the installation directory of this product, there is a possibility that the malicious DLL&nbsp;may be executed by exploiting the product\u2019s behavior of loading missing DLLs from the same directory as the executable during service startup.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-427", "description": "CWE-427 Uncontrolled Search Path Element"}]}], "providerMetadata": {"orgId": "bba440f9-ef23-4224-aa62-7ac0935d18d1", "shortName": "OMRON", "dateUpdated": "2026-04-15T04:11:29.716Z"}}}, "cveMetadata": {"cveId": "CVE-2026-5397", "state": "PUBLISHED", "dateUpdated": "2026-04-15T16:13:26.313Z", "dateReserved": "2026-04-02T00:17:38.524Z", "assignerOrgId": "bba440f9-ef23-4224-aa62-7ac0935d18d1", "datePublished": "2026-04-15T04:11:29.716Z", "assignerShortName": "OMRON"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "platforms": ["Windows"], "product": "PowerAttendant Standard Edition", "vendor": "OMRON SOCIAL SOLUTIONS CO., Ltd.", "versions": [{"status": "affected", "version": "2.1.2 or lower", "versionType": "custom"}]}], "source": "bba440f9-ef23-4224-aa62-7ac0935d18d1"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "It has been identified that a vulnerability (CWE-427) exists in the UPS (Uninterruptible Power Supply) management application, whereby improper permissions on the installation directory allow a malicious actor to place a DLL that\u00a0is then executed with administrator privileges.\n\nIf a malicious DLL is placed in the installation directory of this product, there is a possibility that the malicious DLL\u00a0may be executed by exploiting the product\u2019s behavior of loading missing DLLs from the same directory as the executable during service startup."}, {"lang": "es", "value": "Se ha identificado que existe una vulnerabilidad (CWE-427) en la aplicaci\u00f3n de gesti\u00f3n de SAI (Sistema de Alimentaci\u00f3n Ininterrumpida), por la cual permisos inadecuados en el directorio de instalaci\u00f3n permiten a un actor malicioso colocar una DLL que luego se ejecuta con privilegios de administrador.\n\nSi se coloca una DLL maliciosa en el directorio de instalaci\u00f3n de este producto, existe la posibilidad de que la DLL maliciosa pueda ser ejecutada al explotar el comportamiento del producto de cargar DLLs faltantes desde el mismo directorio que el ejecutable durante el inicio del servicio."}], "id": "CVE-2026-5397", "lastModified": "2026-10-25T23:10:00.167", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.1, "impactScore": 6.0, "source": "bba440f9-ef23-4224-aa62-7ac0935d18d1", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-5397", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-04-15T13:46:38.260570Z", "version": "2.0.3"}}]}, "published": "2026-04-15T05:16:45.740", "references": [{"source": "bba440f9-ef23-4224-aa62-7ac0935d18d1", "url": "https://www.omron.com/global/en/inquiry/data/OMSR-2026-001_en.pdf"}, {"source": "bba440f9-ef23-4224-aa62-7ac0935d18d1", "url": "https://www.omron.com/jp/ja/inquiry/data/OMSR-2026-001_ja.pdf"}], "sourceIdentifier": "bba440f9-ef23-4224-aa62-7ac0935d18d1", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-427"}], "source": "bba440f9-ef23-4224-aa62-7ac0935d18d1", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": ["windows"], "status": "affected", "versions": {"scheme": "semver", "value": "[0,2.1.2]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "manual", "scores": [{"score": 100.0, "source": "manual"}]}, "original": {"product": "PowerAttendant Standard Edition", "source": "cna", "vendor": "OMRON SOCIAL SOLUTIONS CO., Ltd."}, "product": "powerattendant_standard_edition", "vendor": "omron"}], "analysis": {"en": {"generated_at": "2026-04-15T06:21:21.302679+00:00", "value": {"mitigation_remediation": ["Restrict permissions on the PowerAttendant installation directory so that only administrators can write files to it", "Verify that no unexpected DLLs are present in the installation directory and remove any that are not part of the approved package", "Check Omron\u2019s website or contact support for a patch or updated version and apply it as soon as it becomes available"], "summary": {"action": "Patch immediately", "impact": "Execution of arbitrary code with administrator privileges"}, "threat_synthesis": {"affected_systems": "The vulnerability affects Omron Social Solutions Co., Ltd.\u2019s PowerAttendant Standard Edition UPS management application. No specific affected versions are listed, so any release that has not yet disclosed a patch should be considered potentially vulnerable.", "description_and_impact": "The flaw is an uncontrolled search path element (CWE-427) that arises because the UPS management application uses an installation directory with insufficient permissions. A malicious actor can place a DLL in that directory, and when the service starts, the application automatically loads missing DLLs from the same directory. This behavior causes the injected DLL to execute with the service\u2019s administrator privileges, allowing the attacker to run arbitrary code on the system.", "risk_and_exploitability": "The CVSS score of 7.8 indicates a high severity level. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Because the exploitation requires write access to the application\u2019s installation directory, the attack vector is likely local, but once a malicious DLL is placed, the code runs with elevated privileges. The lack of a public workaround increases the risk until an official fix is released."}}}}, "created": "2026-04-15T13:49:14.869099+00:00", "updated": "2026-04-15T14:53:31.486158+00:00", "vendors": ["omron", "omron$PRODUCT$powerattendant_standard_edition"]}