CVE-2026-57895 Privilege escalation in Pupsman
An attacker can achieve arbitrary code execution with SYSTEM privileges by placing a malicious executable in the installation folder due to incorrect default permissions.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-57895?
CVE-2026-57895 is a high-severity vulnerability in Fuji Electric Co.,Ltd. Pupsman, published on 8 Jul 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Incorrect default permissions issue exists in Pupsman versions prior to 3.9.0. An attacker can place a malicious executable in the installation folder, which results in arbitrary code execution with SYSTEM privilege
Weakness: CWE-276
Which versions are affected by CVE-2026-57895?
How do I fix CVE-2026-57895?
No fix has been published for CVE-2026-57895 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-57895 being exploited?
There is no known exploitation of CVE-2026-57895 in the wild and no public exploit code.
Sources
Also known as GHSA-36rv-fhqc-2cfg.