What is the CVSS score of CVE-2026-24694?

CVE-2026-24694 has a CVSS 3.0 base score of 7.8 (High). CVSS vector: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

How to fix or mitigate CVE-2026-24694?

Within 24 hours: Inventory all systems running Roland Cloud Manager and isolate affected machines from sensitive networks if possible. Within 7 days: Contact Roland support for patch availability status and evaluate alternative software solutions. Within 30 days: Implement application whitelisting on affected systems and restrict user permissions to minimize privilege escalation impact; establish vendor communication protocol for patch release notification.

CVE-2026-24694

HIGH

Uncontrolled Search Path Element (CWE-427)

2026-02-03 vultures@jpcert.or.jp

Privilege Escalation RCE

7.8

CVSS 3.0 · NVD

Severity by source

NVD PRIMARY

7.8 HIGH

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:54 vuln.today

CVE Published

Feb 03, 2026 - 06:15 nvd

HIGH 7.8

DescriptionCVE.org

The installer for Roland Cloud Manager ver.3.1.19 and prior insecurely loads Dynamic Link Libraries (DLLs), which could allow an attacker to execute arbitrary code with the privileges of the application.

AnalysisAI

Arbitrary code execution in Roland Cloud Manager installer versions 3.1.19 and earlier results from insecure DLL loading, enabling local attackers to execute malicious code with application-level privileges. An attacker with local access and user interaction can exploit this vulnerability to compromise systems running the affected installer. No patch is currently available to remediate this vulnerability.

Technical ContextAI

Classified as CWE-427 (Uncontrolled Search Path Element). The installer for Roland Cloud Manager ver.3.1.19 and prior insecurely loads Dynamic Link Libraries (DLLs), which could allow an attacker to execute arbitrary code with the privileges of the application.

Affected ProductsAI

The installer for Roland Cloud Manager ver.3.1.19 and prior insecurely loads Dynamic Link Libraries (DLLs), which could allow an attacker to execute a