Ratoc Raid Monitoring Manager For Windows CVE-2026-32680

RATOC RAID Monitoring Manager for Windows installed to a non-default installation folder with insecure ACLs. Attacker requires local non-administrative user access. No victim interaction needed.

The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:L/UI:N) indicates this is a local attack requiring low privileges with low complexity and no user interaction, making it highly exploitable once an attacker has initial access to a system. The vulnerability requires that the software was installed to a custom directory rather than the default location, which may limit the attack surface in practice since many users accept default installation paths. Without available EPSS or KEV data, exploitation likelihood in the wild is uncertain, but the technical simplicity (low complexity, no user interaction required) combined with SYSTEM-level privilege escalation makes this attractive for post-compromise lateral movement and persistence. Organizations using RATOC RAID systems with custom installation paths should prioritize remediation, particularly in multi-user Windows environments where low-privileged accounts exist. The primary risk is in environments where attackers have already gained initial foothold via other means and seek privilege escalation.

An attacker with low-privileged user access to a Windows system running RATOC RAID Monitoring Manager installed in a custom directory identifies the insecure folder permissions. The attacker replaces a legitimate executable or DLL in the installation directory with a malicious version containing their payload. When the RATOC service or application next starts with SYSTEM privileges, the malicious code executes with full system rights, granting the attacker complete control over the machine for activities such as installing backdoors, stealing credentials, or moving laterally across the network.