CVE-2026-5397Vulnerability Related to an Uncontrolled Search Path Element in a UPS Management Application
Updated under an hour ago ()
Does this affect you?
It affects OMRON SOCIAL SOLUTIONS CO., Ltd. PowerAttendant Standard Edition. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
It has been identified that a vulnerability (CWE-427) exists in the UPS (Uninterruptible Power Supply) management application, whereby improper permissions on the installation directory allow a malicious actor to place a DLL that is then executed with administrator privileges. If a malicious DLL is placed in the installation directory of this product, there is a possibility that the malicious DLL may be executed by exploiting the product’s behavior of loading missing DLLs from the same directory as the executable during service startup.
- CVSS
- 7.8 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
- Weakness (CWE)
- CWE-427
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- OMRON
- NVD analysis
- Awaiting Analysis
- Record last updated
- Apr 15, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
OMRON SOCIAL SOLUTIONS CO., Ltd. PowerAttendant Standard Edition omron_social_solutions:powerattendant_standard_edition (from the name) | 2.1.2 or lower | CNA record |
References
- https://www.omron.com/jp/ja/inquiry/data/OMSR-2026-001_ja.pdf
- https://www.omron.com/global/en/inquiry/data/OMSR-2026-001_en.pdf
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.