What is the CVSS score of CVE-2026-2998?

CVE-2026-2998 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

How to fix or mitigate CVE-2026-2998?

Within 24 hours: inventory all systems running eAI Technologies ERP and restrict local file system access to the application directory via file permissions and access controls. Within 7 days: implement application whitelisting on affected systems and segment ERP infrastructure from critical business networks. Within 30 days: conduct a security audit of user access logs for suspicious DLL placement, evaluate alternative ERP solutions, and establish a vendor communication protocol for patch availability updates.

CVE-2026-2998

HIGH

Untrusted Search Path (CWE-426)

2026-02-23 twcert@cert.org.tw

Privilege Escalation RCE

7.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:55 vuln.today

CVE Published

Feb 23, 2026 - 04:16 nvd

HIGH 7.8

DescriptionCVE.org

ERP developed by eAI Technologies has a DLL Hijacking vulnerability, allowing authenticated local attackers to place a crafted DLL file in the same directory as the program, thereby executing arbitrary code.

AnalysisAI

eAI Technologies' ERP application is vulnerable to DLL hijacking attacks that enable authenticated local users to achieve arbitrary code execution by placing a malicious DLL in the application directory. The vulnerability affects any system where non-administrative users have local access and can write to the ERP installation folder. No patch is currently available to remediate this issue.

Technical ContextAI

Classified as CWE-426 (Untrusted Search Path). ERP developed by eAI Technologies has a DLL Hijacking vulnerability, allowing authenticated local attackers to place a crafted DLL file in the same directory as the program, thereby executing arbitrary code.

Affected ProductsAI

ERP developed by eAI Technologies has a DLL Hijacking vulnerability, allowing authenticated local attackers to place a crafted DLL file in the same di