Which versions of eAI ERP are affected by CVE-2026-2998?

An ERP system vulnerability (CVE-2026-2998) allows authenticated local users to execute arbitrary code by placing a malicious file in the application directory.

How to fix or mitigate CVE-2026-2998?

Within 24 hours: inventory all systems running eAI Technologies ERP and restrict local file system access to the application directory via file permissions and access controls. Within 7 days: implement application whitelisting on affected systems and segment ERP infrastructure from critical business networks. Within 30 days: conduct a security audit of user access logs for suspicious DLL placement, evaluate alternative ERP solutions, and establish a vendor communication protocol for patch availability updates.

eAI ERP CVE-2026-2998

Q: What is the CVSS score of CVE-2026-2998?

CVE-2026-2998 has a CVSS 4.0 base score of 8.5 (High). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

HIGH

Untrusted Search Path (CWE-426)

2026-02-23 twcert@cert.org.tw

RCE

8.5

CVSS 4.0 · Vendor: cert

Severity by source

Vendor (cert) PRIMARY

8.5 HIGH

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.8 HIGH

Local vector, low complexity, only low privileges needed; complete compromise of system confidentiality, integrity and availability.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (cert).

CVSS VectorVendor: cert

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Updated

Jul 28, 2026 - 08:27 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jul 28, 2026 - 08:22 vuln.today

cvss_changed

CVSS changed

Jul 28, 2026 - 08:22 NVD

7.8 (HIGH) 8.5 (HIGH)

Analysis Generated

Mar 12, 2026 - 21:55 vuln.today

CVE Published

Feb 23, 2026 - 04:16 nvd

HIGH 7.8

DescriptionCVE.org

ERP developed by eAI Technologies has a DLL Hijacking vulnerability, allowing authenticated local attackers to place a crafted DLL file in the same directory as the program, thereby executing arbitrary code.

AnalysisAI

Authenticated local attackers can achieve arbitrary code execution in eAI ERP via DLL hijacking. By placing a crafted DLL in the same directory as the ERP executable, an attacker can force the application to load malicious code upon launch. No evidence of active exploitation or public exploit code exists; EPSS score is extremely low (0.01%).

Technical ContextAI

The vulnerability is a classic DLL hijacking flaw (CWE-426) where the eAI ERP application loads dynamic-link libraries from its own directory without strict validation. If a malicious DLL with a legitimate-sounding name is placed in that folder, the application may load it instead of the intended system DLL. The affected product is an ERP solution by eAI Technologies, but no Common Platform Enumeration (CPE) data or specific version ranges are available, limiting precise identification of affected installations.

Affected ProductsAI

eAI ERP (exact product name and version range unspecified). No CPE identifiers are available. The initial advisory is hosted at https://www.twcert.org.tw/en/cp-139-10723-14549-2.html, but no vendor-specific product page or patch notice was linked.

RemediationAI

No vendor-released patch was identified at the time of analysis. Until a fixed version is available, restrict write permissions on the eAI ERP installation directory to trusted administrative accounts only, preventing unprivileged users from placing DLL files. Implement application whitelisting (e.g., AppLocker or Windows Defender Application Control) to block unknown DLLs from loading. Monitor file creation events in the ERP directory for suspicious DLL writes. These controls may interfere with legitimate software updates or plugins, so test in a staging environment first.