Pupsman CVE-2026-57895

The attacker must already have local, low-privileged access to a Windows host running Pupsman prior to 3.9.0 (PR:L, AV:L) - there is no remote or network path and no user interaction is required (UI:N). The specific enabling condition is the incorrectly permissive default ACL on the Pupsman installation folder that permits a standard user to write files there, combined with a Pupsman service/task that executes binaries from that folder under SYSTEM. Exploitation is limited by the need for an existing local account or code-execution foothold and by any environment where the installation directory permissions have already been hardened or where only administrators can log on locally.

The vendor-supplied CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:L/UI:N with VC:H/VI:H/VA:H) describes a locally-exploitable, low-complexity flaw that requires the attacker to already hold a low-privileged foothold but grants total system compromise on success - a classic high-value privilege-escalation primitive rather than a remotely wormable bug. No EPSS score, KEV listing, or POC reference is present in the provided data, so exploitation probability cannot be quantified from these sources; the local attack vector inherently limits mass exploitation and favors post-compromise use by an attacker who has already landed on the host. This is a genuine priority on systems where untrusted or standard users share a machine running Pupsman, but lower urgency on single-admin appliances. Note the two references (Fuji Electric product page and the JVN advisory) were provided without descriptive titles, so the exact patched-version confirmation rests on the description's 'prior to 3.9.0' statement.

A standard (non-admin) user or a piece of malware already running with limited privileges on a Windows host writes a malicious executable into the writable Pupsman installation folder, replacing or adding a binary that the SYSTEM-level service or a scheduled task subsequently launches. On next execution - a reboot, service restart, or timed run - the attacker's code runs as SYSTEM, yielding full host takeover. The low attack complexity (AC:L) means no special timing or race is needed; no public POC is referenced in the provided data.