Which versions of Pupsman are affected by EUVD-2026-42165?

Fuji Electric's Pupsman UPS management software contains a local privilege escalation vulnerability (CVSS 8.4) in all versions prior to 3.9.0 that could allow attackers to execute arbitrary code with…

How to fix or mitigate EUVD-2026-42165?

Within 24 hours: Inventory all systems running Pupsman prior to version 3.9.0 and restrict local administrator access; limit installer execution to authorized personnel only. Within 7 days: Deploy file integrity monitoring on Pupsman installation directories to detect unauthorized DLL placement; enable detailed logging for installer execution and review recent activity; enforce Windows UAC requirements. Within 30 days: Test and deploy Pupsman version 3.9.0 immediately upon vendor release; if unavailable, develop alternative UPS management solution and migration timeline to reduce ongoing risk exposure.

Pupsman EUVD-2026-42165

Q: What is the CVSS score of EUVD-2026-42165?

EUVD-2026-42165 has a CVSS 4.0 base score of 8.4 (High). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

| CVE-2026-56437 HIGH

Uncontrolled Search Path Element (CWE-427)

2026-07-08 jpcert

GHSA-jrgq-cr5h-83px

RCE Pupsman

8.4

CVSS 4.0 · Vendor: jpcert

Severity by source

Vendor (jpcert) PRIMARY

8.4 HIGH

CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.8 HIGH

Local DLL-planting with no prior privileges (PR:N) but requiring the victim to run the installer (UI:R); full SYSTEM-level compromise gives C/I/A:H, scope unchanged.

3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (jpcert).

CVSS VectorVendor: jpcert

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Analysis Generated

Jul 08, 2026 - 06:24 vuln.today

CVSS changed

Jul 08, 2026 - 06:22 NVD

7.8 (HIGH) 8.4 (HIGH)

DescriptionCVE.org

Uncontrolled search path element issue exists in Pupsman versions prior to 3.9.0. If a crafted DLL file is placed in the same folder as the affected installer and the installer is executed, arbitrary code may be executed with SYSTEM privilege.

AnalysisAI

Local privilege escalation to arbitrary code execution affects Fuji Electric's Pupsman UPS management software in all versions prior to 3.9.0, where the installer insecurely loads a DLL from its own directory. A local attacker who can drop a malicious DLL into the folder containing the installer can have it executed with SYSTEM privilege the next time the installer is run. No public exploit identified at time of analysis and the flaw is not in CISA KEV; exploitation requires local file placement plus a victim executing the installer (UI:A).

Technical ContextAI

The root cause is CWE-427 (Uncontrolled Search Path Element), commonly known as DLL search-order hijacking or DLL pre-loading/side-loading. Windows resolves an unqualified DLL name by searching a defined order of directories, and by default the application's launch directory is searched early. Because the Pupsman installer references a DLL without a fully-qualified path, an attacker-supplied DLL of the same name placed alongside the installer binary is loaded and its DllMain executes in the installer's security context. Installers frequently run elevated, which is why code execution here lands at SYSTEM. The single affected package is identified by CPE cpe:2.3:a:fuji_electric_co.,ltd.:pupsman:*:*:*:*:*:*:*:*, a power-supply/UPS monitoring utility (tagged RCE, Pupsman).

RemediationAI

Upgrade to Pupsman 3.9.0 or later, which the vendor released to address this issue (Vendor-released patch: 3.9.0); consult the vendor page at https://www.fujielectric.co.jp/products/power_supply/ups/product_detail/software_pupsman.html and the JVN advisory https://jvn.jp/en/jp/JVN62347140/ for download details. Until upgraded, only run the installer from a trusted, non-writable location such as freshly-extracted read-only media or a dedicated directory that no unprivileged user can write to, rather than from shared folders or the browser Downloads directory where an attacker could pre-stage a malicious DLL; verify installer integrity (hash/signature) before execution. The trade-off of these controls is operational friction - staging installers to a locked-down path and hash-checking each run adds steps to deployment workflows but directly removes the attacker's DLL-placement opportunity.