Which versions of Pupsman are affected by EUVD-2026-42166?

Fuji Electric Pupsman versions before 3.9.0 can be compromised by local users to gain complete SYSTEM-level access and full control of operational systems.

How to fix or mitigate EUVD-2026-42166?

24 hours: Audit all systems running Fuji Electric Pupsman to identify version numbers and deployment scope; immediately restrict file permissions on Pupsman installation directories to prevent unauthorized executable creation. 7 days: Implement directory monitoring and alerting for suspicious file writes in Pupsman installation paths; review and enforce principle of least privilege for all local user accounts. 30 days: Upgrade to Fuji Electric Pupsman version 3.9.0 or later once released and validated; test patch in non-production environment before enterprise deployment.

Pupsman EUVD-2026-42166

Q: What is the CVSS score of EUVD-2026-42166?

EUVD-2026-42166 has a CVSS 4.0 base score of 8.5 (High). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

| CVE-2026-57895 HIGH

Incorrect Default Permissions (CWE-276)

2026-07-08 jpcert

GHSA-36rv-fhqc-2cfg

Privilege Escalation RCE Pupsman

8.5

CVSS 4.0 · Vendor: jpcert

Severity by source

Vendor (jpcert) PRIMARY

8.5 HIGH

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.8 HIGH

Local vector and low-privileged foothold required (AV:L, PR:L), no user interaction and low complexity, with full SYSTEM-level C/I/A impact; scope unchanged as the service runs on the same OS.

3.1 AV:L/AC:L/PR:L/UI:N/S:N/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (jpcert).

CVSS VectorVendor: jpcert

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 08, 2026 - 06:23 vuln.today

CVSS changed

Jul 08, 2026 - 06:22 NVD

7.8 (HIGH) 8.5 (HIGH)

DescriptionCVE.org

Incorrect default permissions issue exists in Pupsman versions prior to 3.9.0. An attacker can place a malicious executable in the installation folder, which results in arbitrary code execution with SYSTEM privilege

AnalysisAI

Local privilege escalation to SYSTEM in Fuji Electric Pupsman before version 3.9.0 allows a low-privileged local user to drop a malicious executable into the weakly-permissioned installation directory, which is then run with SYSTEM privileges for full arbitrary code execution. Reported through JPCERT/CC (JVN JVN62347140); no public exploit identified and no active exploitation is confirmed at time of analysis. The CVSS 4.0 base score is 8.5 (High), reflecting complete confidentiality, integrity, and availability impact despite the local attack vector.

Technical ContextAI

Pupsman is Fuji Electric's UPS (uninterruptible power supply) monitoring and management software for Windows, typically running a service under the SYSTEM account. The root cause is CWE-276 (Incorrect Default Permissions): the product's installation folder is created with overly permissive ACLs that let non-administrative users write to it. Because a SYSTEM-context service or scheduled task executes binaries from that directory, any executable a standard user plants there inherits SYSTEM privileges. The single affected CPE is cpe:2.3:a:fuji_electric_co.,ltd.:pupsman, confirming this is application-level rather than an OS or protocol flaw.

RemediationAI

Vendor-released patch: upgrade Pupsman to version 3.9.0 or later, which corrects the installation-folder permissions; download and advisory details are on the Fuji Electric page (https://www.fujielectric.co.jp/products/power_supply/ups/product_detail/software_pupsman.html) and JVN (https://jvn.jp/en/jp/JVN62347140/). Where immediate patching is not possible, the direct compensating control is to tighten the ACLs on the Pupsman installation directory so that only Administrators and SYSTEM have write/modify permissions and standard users are restricted to read/execute - this directly removes the attacker's ability to plant a binary, with the trade-off that a future in-place update or repair run by the installer may reset directory permissions and must be re-hardened afterward. Additionally, restrict interactive and local logon on hosts running the Pupsman service to trusted administrators to shrink the pool of potential low-privileged attackers.