Which versions of HYPER SBI 2 are affected by CVE-2026-42936?

HYPER SBI 2, SBI Securities' primary online trading platform used by Japanese financial customers, contains an arbitrary code execution vulnerability (CVE-2026-42936, CVSS 8.4) exploitable by local…

How to fix or mitigate CVE-2026-42936?

Within 24 hours: Identify all SBI Securities customers and HYPER SBI 2 deployments in your environment; send security notifications warning users to avoid launching installers from shared or untrusted directories and to verify installer authenticity before execution. Within 7 days: Deploy application whitelisting controls to restrict installer execution only from verified vendor paths, enable Windows DLL signing enforcement to block unsigned DLL injection, and activate EDR/SIEM monitoring for anomalous DLL activity within installer directories. Within 30 days: Establish daily monitoring of JPCERT/CC and JVN advisory feeds for patch release; when vendor patch becomes available, schedule emergency deployment within 48 hours; concurrently evaluate whether alternative trading platforms with more robust security patch schedules are operationally viable.

HYPER SBI 2 CVE-2026-42936

Q: What is the CVSS score of CVE-2026-42936?

CVE-2026-42936 has a CVSS 4.0 base score of 8.4 (High). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-44591 HIGH

Uncontrolled Search Path Element (CWE-427)

2026-07-15 jpcert

GHSA-j386-q724-3f5c

RCE Hyper Sbi 2

8.4

CVSS 4.0 · Vendor: jpcert

Severity by source

Vendor (jpcert) PRIMARY

8.4 HIGH

CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.8 HIGH

Local because the malicious DLL must be co-located (AV:L) and the victim must run the installer (UI:R); no prior privileges needed (PR:N) and successful load yields full user-level compromise (C/I/A:H).

3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (jpcert).

CVSS VectorVendor: jpcert

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Analysis Updated

Jul 15, 2026 - 06:28 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jul 15, 2026 - 06:23 vuln.today

cvss_changed

CVSS changed

Jul 15, 2026 - 06:23 NVD

7.8 (HIGH) 8.4 (HIGH)

Analysis Generated

Jul 15, 2026 - 05:50 vuln.today

CVE Published

Jul 15, 2026 - 05:12 cve.org

HIGH 7.8

DescriptionCVE.org

The installer of HYPER SBI 2 insecurely loads Dynamic Link Libraries. If there is a crafted DLL at the same directory when invoking the affected installer, arbitrary code may be executed with the privilege of the user invoking the installer.

AnalysisAI

Arbitrary code execution in the HYPER SBI 2 installer (SBI Securities' online trading application) allows a local attacker to run code with the invoking user's privileges by planting a crafted DLL in the installer's directory. The flaw stems from insecure DLL search-path loading (CWE-427) and requires the victim to launch the installer from an attacker-influenced folder. No public exploit has been identified at time of analysis; the issue was reported by JPCERT/CC and published via JVN.

Technical ContextAI

The vulnerability is a classic DLL hijacking / uncontrolled search path element (CWE-427). On Windows, executables resolve dependent DLLs through an ordered search path that, in insecure configurations, includes the current working directory or the executable's own directory before trusted system paths. The HYPER SBI 2 installer loads one or more DLLs by name without specifying a fully-qualified trusted path, so a malicious DLL of the expected name placed alongside the installer is loaded and its entry point executed in-process. The affected component per CPE is cpe:2.3:a:sbi_securities_co.,ltd.:hyper_sbi_2, a desktop trading client distributed to retail brokerage customers in Japan.

RemediationAI

Obtain and run only the latest installer directly from SBI Securities' official distribution per the JVN advisory (https://jvn.jp/en/jp/JVN59875262/); a fixed installer that resolves DLLs from trusted absolute paths is the primary remedy - an exact patched version number is not stated in the available data, so consult the vendor advisory for the current build. Until updating, do not launch the installer from shared, browser-download, temporary, or otherwise writable directories that may contain untrusted files; instead move the installer into a newly created, empty, trusted folder (e.g., a fresh directory under the user profile) before running it, which prevents a co-located malicious DLL from being loaded. As a broader control, restrict write access to download directories and use application allow-listing to block unsigned DLLs from loading; the trade-off is added friction for legitimate installs and potential false positives on other software.