Vulnerability-Lookup

CVE-2026-5397 (GCVE-0-2026-5397)

Vulnerability from cvelistv5 – Published: 2026-04-15 04:11 – Updated: 2026-04-15 16:13

Title

Vulnerability Related to an Uncontrolled Search Path Element in a UPS Management Application

Summary

It has been identified that a vulnerability (CWE-427) exists in the UPS (Uninterruptible Power Supply) management application, whereby improper permissions on the installation directory allow a malicious actor to place a DLL that is then executed with administrator privileges. If a malicious DLL is placed in the installation directory of this product, there is a possibility that the malicious DLL may be executed by exploiting the product’s behavior of loading missing DLLs from the same directory as the executable during service startup.

Severity

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator (v2.0.3)

CWE

CWE-427 - Uncontrolled Search Path Element

Assigner

OMRON

References

2 references

URL	Tags
https://www.omron.com/jp/ja/inquiry/data/OMSR-202…
https://www.omron.com/global/en/inquiry/data/OMSR…

Impacted products

1 product

Vendor	Product	Version
OMRON SOCIAL SOLUTIONS CO., Ltd.	PowerAttendant Standard Edition	Affected: 2.1.2 or lower (custom)

Date Public

2026-04-15 04:08

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-5397",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-04-15T13:46:38.260570Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-04-15T16:13:26.313Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "platforms": [
            "Windows"
          ],
          "product": "PowerAttendant Standard Edition",
          "vendor": "OMRON SOCIAL SOLUTIONS CO., Ltd.",
          "versions": [
            {
              "status": "affected",
              "version": "2.1.2 or lower",
              "versionType": "custom"
            }
          ]
        }
      ],
      "datePublic": "2026-04-15T04:08:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cdiv\u003eIt has been identified that a vulnerability (CWE-427) exists in the UPS (Uninterruptible Power Supply) management application, whereby improper permissions on the installation directory allow a malicious actor to place a DLL that\u0026nbsp;is then executed with administrator privileges.\u003c/div\u003eIf a malicious DLL is placed in the installation directory of this product, there is a possibility that the malicious DLL\u0026nbsp;may be executed by exploiting the product\u2019s behavior of loading missing DLLs from the same directory as the executable during service startup."
            }
          ],
          "value": "It has been identified that a vulnerability (CWE-427) exists in the UPS (Uninterruptible Power Supply) management application, whereby improper permissions on the installation directory allow a malicious actor to place a DLL that\u00a0is then executed with administrator privileges.\n\nIf a malicious DLL is placed in the installation directory of this product, there is a possibility that the malicious DLL\u00a0may be executed by exploiting the product\u2019s behavior of loading missing DLLs from the same directory as the executable during service startup."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-471",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-471 Search Order Hijacking"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-427",
              "description": "CWE-427 Uncontrolled Search Path Element",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-15T04:11:29.716Z",
        "orgId": "bba440f9-ef23-4224-aa62-7ac0935d18d1",
        "shortName": "OMRON"
      },
      "references": [
        {
          "url": "https://www.omron.com/jp/ja/inquiry/data/OMSR-2026-001_ja.pdf"
        },
        {
          "url": "https://www.omron.com/global/en/inquiry/data/OMSR-2026-001_en.pdf"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Vulnerability Related to an Uncontrolled Search Path Element in a UPS Management Application",
      "x_generator": {
        "engine": "Vulnogram 1.0.1"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "bba440f9-ef23-4224-aa62-7ac0935d18d1",
    "assignerShortName": "OMRON",
    "cveId": "CVE-2026-5397",
    "datePublished": "2026-04-15T04:11:29.716Z",
    "dateReserved": "2026-04-02T00:17:38.524Z",
    "dateUpdated": "2026-04-15T16:13:26.313Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-5397",
      "date": "2026-06-02",
      "epss": "0.00014",
      "percentile": "0.02595"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-5397\",\"sourceIdentifier\":\"bba440f9-ef23-4224-aa62-7ac0935d18d1\",\"published\":\"2026-04-15T05:16:45.740\",\"lastModified\":\"2026-04-17T15:17:00.957\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"It has been identified that a vulnerability (CWE-427) exists in the UPS (Uninterruptible Power Supply) management application, whereby improper permissions on the installation directory allow a malicious actor to place a DLL that\u00a0is then executed with administrator privileges.\\n\\nIf a malicious DLL is placed in the installation directory of this product, there is a possibility that the malicious DLL\u00a0may be executed by exploiting the product\u2019s behavior of loading missing DLLs from the same directory as the executable during service startup.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"bba440f9-ef23-4224-aa62-7ac0935d18d1\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.1,\"impactScore\":6.0}]},\"weaknesses\":[{\"source\":\"bba440f9-ef23-4224-aa62-7ac0935d18d1\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-427\"}]}],\"references\":[{\"url\":\"https://www.omron.com/global/en/inquiry/data/OMSR-2026-001_en.pdf\",\"source\":\"bba440f9-ef23-4224-aa62-7ac0935d18d1\"},{\"url\":\"https://www.omron.com/jp/ja/inquiry/data/OMSR-2026-001_ja.pdf\",\"source\":\"bba440f9-ef23-4224-aa62-7ac0935d18d1\"}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-5397\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-04-15T13:46:38.260570Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-04-15T13:46:44.852Z\"}}], \"cna\": {\"title\": \"Vulnerability Related to an Uncontrolled Search Path Element in a UPS Management Application\", \"source\": {\"discovery\": \"UNKNOWN\"}, \"impacts\": [{\"capecId\": \"CAPEC-471\", \"descriptions\": [{\"lang\": \"en\", \"value\": \"CAPEC-471 Search Order Hijacking\"}]}], \"metrics\": [{\"format\": \"CVSS\", \"cvssV3_1\": {\"scope\": \"CHANGED\", \"version\": \"3.1\", \"baseScore\": 7.8, \"attackVector\": \"LOCAL\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"HIGH\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"HIGH\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"affected\": [{\"vendor\": \"OMRON SOCIAL SOLUTIONS CO., Ltd.\", \"product\": \"PowerAttendant Standard Edition\", \"versions\": [{\"status\": \"affected\", \"version\": \"2.1.2 or lower\", \"versionType\": \"custom\"}], \"platforms\": [\"Windows\"], \"defaultStatus\": \"unaffected\"}], \"datePublic\": \"2026-04-15T04:08:00.000Z\", \"references\": [{\"url\": \"https://www.omron.com/jp/ja/inquiry/data/OMSR-2026-001_ja.pdf\"}, {\"url\": \"https://www.omron.com/global/en/inquiry/data/OMSR-2026-001_en.pdf\"}], \"x_generator\": {\"engine\": \"Vulnogram 1.0.1\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"It has been identified that a vulnerability (CWE-427) exists in the UPS (Uninterruptible Power Supply) management application, whereby improper permissions on the installation directory allow a malicious actor to place a DLL that\\u00a0is then executed with administrator privileges.\\n\\nIf a malicious DLL is placed in the installation directory of this product, there is a possibility that the malicious DLL\\u00a0may be executed by exploiting the product\\u2019s behavior of loading missing DLLs from the same directory as the executable during service startup.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"\u003cdiv\u003eIt has been identified that a vulnerability (CWE-427) exists in the UPS (Uninterruptible Power Supply) management application, whereby improper permissions on the installation directory allow a malicious actor to place a DLL that\u0026nbsp;is then executed with administrator privileges.\u003c/div\u003eIf a malicious DLL is placed in the installation directory of this product, there is a possibility that the malicious DLL\u0026nbsp;may be executed by exploiting the product\\u2019s behavior of loading missing DLLs from the same directory as the executable during service startup.\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-427\", \"description\": \"CWE-427 Uncontrolled Search Path Element\"}]}], \"providerMetadata\": {\"orgId\": \"bba440f9-ef23-4224-aa62-7ac0935d18d1\", \"shortName\": \"OMRON\", \"dateUpdated\": \"2026-04-15T04:11:29.716Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-5397\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-04-15T16:13:26.313Z\", \"dateReserved\": \"2026-04-02T00:17:38.524Z\", \"assignerOrgId\": \"bba440f9-ef23-4224-aa62-7ac0935d18d1\", \"datePublished\": \"2026-04-15T04:11:29.716Z\", \"assignerShortName\": \"OMRON\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2026-5397

Vulnerability from fkie_nvd - Published: 2026-04-15 05:16 - Updated: 2026-04-17 15:17

Severity

7.8 (High) - CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

Summary

References

	URL	Tags
	bba440f9-ef23-4224-aa62-7ac0935d18d1	https://www.omron.com/global/en/inquiry/data/OMSR-2026-001_en.pdf
	bba440f9-ef23-4224-aa62-7ac0935d18d1	https://www.omron.com/jp/ja/inquiry/data/OMSR-2026-001_ja.pdf

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "It has been identified that a vulnerability (CWE-427) exists in the UPS (Uninterruptible Power Supply) management application, whereby improper permissions on the installation directory allow a malicious actor to place a DLL that\u00a0is then executed with administrator privileges.\n\nIf a malicious DLL is placed in the installation directory of this product, there is a possibility that the malicious DLL\u00a0may be executed by exploiting the product\u2019s behavior of loading missing DLLs from the same directory as the executable during service startup."
    }
  ],
  "id": "CVE-2026-5397",
  "lastModified": "2026-04-17T15:17:00.957",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "HIGH",
          "attackVector": "LOCAL",
          "availabilityImpact": "HIGH",
          "baseScore": 7.8,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "CHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 1.1,
        "impactScore": 6.0,
        "source": "bba440f9-ef23-4224-aa62-7ac0935d18d1",
        "type": "Secondary"
      }
    ]
  },
  "published": "2026-04-15T05:16:45.740",
  "references": [
    {
      "source": "bba440f9-ef23-4224-aa62-7ac0935d18d1",
      "url": "https://www.omron.com/global/en/inquiry/data/OMSR-2026-001_en.pdf"
    },
    {
      "source": "bba440f9-ef23-4224-aa62-7ac0935d18d1",
      "url": "https://www.omron.com/jp/ja/inquiry/data/OMSR-2026-001_ja.pdf"
    }
  ],
  "sourceIdentifier": "bba440f9-ef23-4224-aa62-7ac0935d18d1",
  "vulnStatus": "Awaiting Analysis",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-427"
        }
      ],
      "source": "bba440f9-ef23-4224-aa62-7ac0935d18d1",
      "type": "Secondary"
    }
  ]
}

GHSA-WX9R-9HF2-WQ9P

Vulnerability from github – Published: 2026-04-17 15:31 – Updated: 2026-04-17 15:31

Details

If a malicious DLL is placed in the installation directory of this product, there is a possibility that the malicious DLL may be executed by exploiting the product’s behavior of loading missing DLLs from the same directory as the executable during service startup.

Severity

7.8 (High)


                  
                    CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-5397"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-427"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-04-15T05:16:45Z",
    "severity": "HIGH"
  },
  "details": "It has been identified that a vulnerability (CWE-427) exists in the UPS (Uninterruptible Power Supply) management application, whereby improper permissions on the installation directory allow a malicious actor to place a DLL that\u00a0is then executed with administrator privileges.\n\nIf a malicious DLL is placed in the installation directory of this product, there is a possibility that the malicious DLL\u00a0may be executed by exploiting the product\u2019s behavior of loading missing DLLs from the same directory as the executable during service startup.",
  "id": "GHSA-wx9r-9hf2-wq9p",
  "modified": "2026-04-17T15:31:17Z",
  "published": "2026-04-17T15:31:17Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-5397"
    },
    {
      "type": "WEB",
      "url": "https://www.omron.com/global/en/inquiry/data/OMSR-2026-001_en.pdf"
    },
    {
      "type": "WEB",
      "url": "https://www.omron.com/jp/ja/inquiry/data/OMSR-2026-001_ja.pdf"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

JVNDB-2026-011472

Vulnerability from jvndb - Published: 2026-04-17 14:54 - Updated:2026-04-17 14:54

Summary

OMRON UPS (Uninterruptible Power Supply) management application may insecurely load Dynamic Link Libraries

Details

The UPS (Uninterruptible Power Supply) management application provided by OMRON Corporation may insecurely load Dynamic Link Libraries due to an issue with uncontrolled search path element (CWE-427, CVE-2026-5397). OMRON Corporation reported this vulnerability to JPCERT/CC to notify users of its solution through JVN.

References

Type

URL

	JVN	https://jvn.jp/en/vu/JVNVU94583735/index.html
	JVN	https://jvn.jp/en/ta/JVNTA91240916/
	CVE	https://www.cve.org/CVERecord?id=CVE-2026-5397
	Uncontrolled Search Path Element(CWE-427)	https://cwe.mitre.org/data/definitions/427.html

Impacted products

Vendor

Product

OMRON SOCIAL SOLUTIONS Co.,Ltd.

PowerAttendant Standard Edition

Show details on JVN DB website

JSON

To clipboard

{
  "@rdf:about": "https://jvndb.jvn.jp/en/contents/2026/JVNDB-2026-011472.html",
  "dc:date": "2026-04-17T14:54+09:00",
  "dcterms:issued": "2026-04-17T14:54+09:00",
  "dcterms:modified": "2026-04-17T14:54+09:00",
  "description": "The UPS (Uninterruptible Power Supply) management application provided by OMRON Corporation may insecurely load Dynamic Link Libraries due to an issue with uncontrolled search path element (CWE-427, CVE-2026-5397).\r\n\r\nOMRON Corporation reported this vulnerability to JPCERT/CC to notify users of its solution through JVN.",
  "link": "https://jvndb.jvn.jp/en/contents/2026/JVNDB-2026-011472.html",
  "sec:cpe": {
    "#text": "cpe:/a:omron_socilal_solutions:powerattendant_standard_edition",
    "@product": "PowerAttendant Standard Edition",
    "@vendor": "OMRON SOCIAL SOLUTIONS Co.,Ltd.\t",
    "@version": "2.2"
  },
  "sec:identifier": "JVNDB-2026-011472",
  "sec:references": [
    {
      "#text": "https://jvn.jp/en/vu/JVNVU94583735/index.html",
      "@id": "JVNVU#94583735",
      "@source": "JVN"
    },
    {
      "#text": "https://jvn.jp/en/ta/JVNTA91240916/",
      "@id": "JVNTA#91240916",
      "@source": "JVN"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2026-5397",
      "@id": "CVE-2026-5397",
      "@source": "CVE"
    },
    {
      "#text": "https://cwe.mitre.org/data/definitions/427.html",
      "@id": "CWE-427",
      "@title": "Uncontrolled Search Path Element(CWE-427)"
    }
  ],
  "title": "OMRON UPS (Uninterruptible Power Supply) management application may insecurely load Dynamic Link Libraries"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CVE-2026-5397 (GCVE-0-2026-5397)

FKIE_CVE-2026-5397

GHSA-WX9R-9HF2-WQ9P

JVNDB-2026-011472

Tags

Sightings

Nomenclature